How PakkaProof keeps evidence honest

• Recording happens in one continuous take. There is no pause button, and if the camera stops or the app is left mid-recording, the take is discarded.
• The phone computes the video's SHA-256 fingerprint before upload. The server records that fingerprint with its own timestamp; the phone's clock can't backdate it.
• The upload link is bound to that fingerprint. Storage rejects any bytes that don't match, so a file can't be swapped between sealing and upload.
• Recording is only possible for orders the marketplace has confirmed (the Gate), and each capture session carries a signed ticket proving it.

Videos are stored in Cloudflare R2 with retention locks: once written, an object cannot be overwritten or deleted until its retention period ends (90 days, 12 or 24 months by plan). That applies to PakkaProof's own staff too.

• Buyers who open a verification link have their own browser re-compute the fingerprint and compare it with the sealed value, rather than trusting PakkaProof's word.
• A scheduled job re-hashes stored videos and records every result in an append-only table. Any mismatch raises an internal alert.

• Every table uses PostgreSQL row-level security: a business can only ever read its own orders and evidence.
• Evidence records, buyer responses, integrity checks, billing events and the audit log are append-only at the database level: updates and deletes are rejected outright.
• Plans and limits can only be changed by verified Razorpay webhooks or an audit-logged staff override, never by an account holder.
• Data is encrypted in transit (TLS) and at rest by our storage providers.

We report cyber security incidents to CERT-In within 6 hours of becoming aware of them, as required by its directions, and notify affected customers and the Data Protection Board of India as required by the DPDP Act. We retain system logs as those directions require.

Email security@pakkaproof.in with details and steps to reproduce. Please give us reasonable time to fix an issue before disclosing it. We won't take action against good-faith research that avoids privacy violations and service disruption.