The seal
What the seal proves
Segel does not promise that forgery is impossible. Segel makes an approval record whose changes can be detected and re-checked by anyone holding the file. This page sets out each layer of evidence, what it proves, and the limits to understand.
In one line
- What it is
- Electronic approval record for PDFs
- What it is not
- Qualified electronic signature
- Hash
- SHA-256, for the document and the sealed package
- Timestamp
- RFC 3161
- Record
- Hash-chained audit log
- Verification
- Public page and QR
Key facts
| Hash type | SHA-256 for the document and the sealed package |
|---|---|
| Timestamp authority | RFC 3161. The sample record uses DigiCert TSA |
| What is recorded | Submitter, approvers, decisions, times, document version, and audit root |
| What is not recorded | The verification page does not show document content or amounts by default |
| Package hash | Stored in the seal record and shown on the verification page, not inside the certificate |
The five evidence layers
Each layer answers one narrow question. Together they make a consistent story hard to maintain once any part is changed.
- 01
SHA-256 document hash
- Proves
- The document content has not changed since sealing.
- Does not prove
- It does not prove that the content is correct.
- 02
SHA-256 package hash
- Proves
- The sealed file has not changed since sealing.
- Does not prove
- It does not prove the file came from a legitimate issuer.
- 03
Audit chain
- Proves
- The event history has not been rewritten.
- Does not prove
- It does not prove that every decision was wise.
- 04
RFC 3161 timestamp
- Proves
- The record existed at the time signed by the time authority.
- Does not prove
- It does not prove that time matches your office clock.
- 05
Public verification
- Proves
- Anyone holding the file can check its record.
- Does not prove
- It does not prove the issuer is always honest about the contents.
What Segel is not
These limits matter as much as the seal's capabilities. Stating them makes the smaller claim easier to defend.
- Not a certified electronic signature and not a certification provider.
- Not an ERP, not a document management system, and not a replacement for accounting software.
- Not a guarantee that the contents are correct or the decision was sound.
- Not a guarantee that a document is automatically valid under any particular law.
- Not a guarantee that the person behind an account is who they claim to be. Access control still matters.
Further reading
Questions about the seal
What makes a Segel record tamper-evident?
The document hash, package hash, audit chain, and timestamp hold each other up. If the document content, the history, or the sealed file changes, the values no longer match and the check shows it.
Does Segel make a document impossible to forge?
No. A digital file can always be copied and edited. Segel makes the change detectable rather than preventing it. The accurate claim is tamper-evident, not tamper-proof.
Who can check a sealed record?
Anyone holding the file or the verification link. Checking needs no account and does not depend on access to the issuing organisation's internal systems.