Every Set of Books Arrives With an Implicit “Trust Us”

When a bank asks for your year-end financials, what arrives is a PDF. It might have been produced from the ledger this morning or assembled in a spreadsheet last night. The bank cannot tell. Its recourse is to trust your accountant, or to pay an auditor to go and look.

That is not a criticism of anyone in the chain. It is a property of the format: a document carries no evidence of its own provenance, so every party downstream is trusting the party upstream. The cost of that shows up as audit fees, as diligence timelines, and as covenant reporting nobody quite believes.

• History is never overwritten. Every record is sealed to the one before it, and a correction is a new entry that reverses the old one, so the original stays in the books.

• The books' tamper-evident seal is re-checked automatically on a schedule, and a break raises an alert rather than waiting to be discovered during an audit.

• A delivered package is frozen at a point in time and given a unique seal, so what the recipient holds can be checked against what was sent rather than taken on trust.

• Every pack you issue is recorded with a unique seal, so you can say exactly what you sent, when, and prove it has not changed since.

• A recipient checks a delivered package on their own computer, with a tool that travels inside the package, installs nothing and contacts no one.

• Every package explains its own verification: how to run the check, what a pass proves, what it does not, and how to confirm it against someone who does not hold your copy.

• A recipient can ask whether the package they hold is still the current one, and be told if it has been superseded or if the books have moved since it was issued.

History is never overwritten, the seal is checked on a schedule rather than when someone thinks to look, a delivered package is frozen and sealed, and what you sent is on a register. The check also runs on the recipient’s own computer: every package carries a small program that recomputes each file’s fingerprint and reports whether anything has changed. It contacts nothing and installs nothing.

A recipient can also ask a question the document itself cannot answer — whether the pack they are holding is still the current one. A March pack sent to a bank on 3 April is perfectly intact after a correction is backdated into March on the 20th, and it is no longer what the books say. Being told that is against our short-term interest, which is part of why it is worth having.

This is the piece that matters most, because it is the only one that does not depend on us at all — and it is the piece that closes the limit described above.

An independent timestamp authority attests that a package existed on the date it claims. The recipient checks that attestation with standard tools, against a certificate fetched from the authority rather than from us — so the last step of the proof rests on someone we do not control.

A timestamp from an independent authority attests that a package’s contents existed on the date it claims, under a signature we cannot forge, backdate or reissue. A recipient checks it with standard tools and a certificate they fetch from that authority rather than from us — which is what removes the last place our word is load-bearing, and closes the limit described above.

The destination is a network where the recipient of a statement — a lender, an investor, an acquirer — verifies it directly, and trust stops being bilateral.Where this is going

Accounting software has spent forty years getting better at producing numbers and almost no time at making them checkable. The reason is that nobody could: a ledger you can edit in place has nothing to prove. Once history is never overwritten and every document carries a seal, the question “can the recipient verify this themselves?” becomes answerable — and for the packages this system issues, the answer is now yes.

We think that is a category rather than a feature, and we are calling it verifiable accounting. We would rather be early and say so than arrive later claiming we always meant this.