When you sell regulated products, having the right checks in place is only half the job. You also need a record that shows they ran, order by order. Claddr keeps that record as an audit ledger. This explainer covers what goes into it, how it makes later edits visible, and what an export contains.
What gets recorded for each order
Every order that goes through Claddr adds an entry to your ledger. Each entry records:
- The buyer qualification result. The outcome of the qualification checks that applied to the order.
- The signed attestation. The statement the buyer signed, and the version of that statement. If you change the wording later, older orders still show the exact version each buyer signed.
- The rules applied. The rules Claddr applied to the order, so you can see later which requirements were in force at the time.
- The Stripe charge reference. The reference for the related charge in Stripe, so you can match a ledger entry to its payment.
Together, these answer three questions about any order: what was checked, what the buyer agreed to, and which payment it belongs to.
How the chain works
Each entry is hashed. A hash is a short fingerprint calculated from the contents of the entry. Change even one character of the entry and the fingerprint comes out completely different.
Claddr links the entries together. Each new entry includes the hash of the entry before it, and its own hash is calculated with that included. The result is a chain. Every entry depends on the one before it, all the way back to the first.
That is what makes the record tamper-evident. If an entry is edited, removed or reordered after it was written, its hash no longer matches, and every link after it breaks. Recalculating the hashes from the start shows where the chain stops matching.
What tamper-evident means, and what it does not
Tamper-evident means a change made after the fact can be detected. It does not mean a change is impossible. It means the change shows.
It also has limits worth stating plainly. The chain shows that entries have not been altered since they were written. It does not prove on its own that the information in an entry was correct when it was written, and it does not make your controls right for your business.
Nor is it independent verification. The chain is checked against the record itself. If you need assurance from outside your business, that is a separate step, such as a review by your own auditor or counsel.
The chain is also only as useful as the copies you keep. An export you hold is a fixed copy of the record at that moment. Comparing a later export against it is a simple way to confirm that earlier entries still read the same.
What an export contains
When you export your record, the package includes:
- A controls summary PDF. A readable overview of your controls, for people who would rather not read raw data.
- A CSV of ledger entries. One row per entry, including each entry’s hash, so the data can be filtered, sorted and reviewed.
- Scan history. The history of scans on your account.
- Instructions to check the chain. The steps for recalculating the hashes and confirming that the chain is intact.
Using the record well
A ledger records what your controls did. It cannot make weak controls strong. Set rules that fit the products you sell and the laws that apply to you, and review them when either changes.
Export your record regularly and keep the exports somewhere you control. Check the chain from time to time, not only when someone asks for it. A record is most useful when you already know it is in order.
This guide is general information, not legal advice.