EvidenceChain

Cryptographic Audit Trail, Merkle Tree Immutability, and Legal-Grade Digital Forensics Ledger for Java & Spring Boot

---

Overview

In critical regulatory environments (DORA, NIS2, ISO 27001, SOC 2, HIPAA, GDPR), standard application database logs do not possess evidentiary validity in court or regulatory inquiries because any database administrator or compromised service account can silently modify historical rows or timestamps.

EvidenceChain is a high-performance cryptographic audit ledger designed and certified by a Perito Informático Colegiado (Certified Judicial Computer Expert Nº 03624). It binds business events into an append-only cryptographic chain using binary SHA-256 Merkle trees, delivering mathematical proof of tampering and automated court-admissible forensic certificates.

---

Key Features

• SHA-256 Merkle Tree Integrity: Each audit record is cryptographically linked to the preceding event. Changing or deleting a single historical byte immediately invalidates the Merkle Root.
• $O(\log N)$ Merkle Inclusion Proofs: Prove that a specific event exists in an audited ledger without disclosing or transmitting the surrounding database contents.
• Forensic Judicial Certificates: Generate formal digital chain of custody reports ready for submission in judicial proceedings or regulatory audits.
• Declarative Spring Boot Integration: Annotate business methods with @AuditedEvidence to capture immutable audit blocks automatically.

---

Installation

Core Engine

<dependency>
    <groupId>io.github.frodygr</groupId>
    <artifactId>evidencechain-core</artifactId>
    <version>0.1.0</version>
</dependency>

Spring Boot 3 Starter

<dependency>
    <groupId>io.github.frodygr</groupId>
    <artifactId>evidencechain-spring-boot-starter</artifactId>
    <version>0.1.0</version>
</dependency>

---

Quickstart

Native Java Usage

EvidenceChainLedger ledger = new EvidenceChainLedger();

// 1. Record critical business actions
ledger.record("user-491", "FUNDS_TRANSFERRED", "Account/ES9121...", Map.of("amount", "5000.00", "currency", "EUR"));
ledger.record("officer-10", "KYC_APPROVED", "User/491", Map.of("document", "PASSPORT"));

// 2. Mathematically verify entire ledger
VerificationReport report = ledger.verify();
System.out.println("Ledger Valid: " + report.valid()); // true
System.out.println("Merkle Root:  " + report.computedMerkleRoot());

// 3. Export forensic legal certificate
ForensicReportExporter exporter = new ForensicReportExporter();
String certificate = exporter.generateCertificate(ledger, "CASE-2026-AUDIT-01");
System.out.println(certificate);

Spring Boot 3 Declarative Usage

@Service
public class TreasuryService {

    @AuditedEvidence(action = "WIRE_TRANSFER", resource = "TreasuryVault")
    public void executeWireTransfer(String recipient, double amount) {
        // Business logic runs normally
        // Arguments and timestamp are cryptographically hashed and linked to the ledger!
    }
}

---

Documentation

Comprehensive architecture diagrams, compliance mapping, and API specifications are available in the Official Wiki.

---

License

Licensed under the Apache License, Version 2.0.
Architected by Carlos Expósito (Perito Informático Colegiado Nº 03624).