Security & compliance
Trust isn't declared, it's verified
Every claim on this page is checkable: by the hash you can recompute yourself, by the timestamp you can validate against the issuing authority, or by the access log you can consult.
How the chain of custody holds up
Seven technical guarantees, not a promise
Artifact integrity
SHA-256 computed client-side before upload, and recalculated by the server in the same step it writes the file to disk — if it doesn't match, the upload is rejected and nothing is kept.
Dual timestamp
An RFC 3161 timestamp from the client at the moment of acquisition, plus a second, independent timestamp obtained by the server over the already-verified hash.
Chained hash
Every artifact in a session cryptographically references the previous one — additional evidence that nothing was inserted or reordered after the fact.
Immutable (WORM) storage
Every accepted blob is marked read-only at the filesystem level; neither a deletion nor a direct write works on it afterwards.
Read audit log
Not just who generated the evidence — also who viewed or downloaded it afterwards: IP, host, browser and approximate location for each access, plus which authorized contact did so if the case requires a second factor.
Public or private verification, with 2FA
By default, the link or QR code is already enough. A case can be marked private and require a second factor as well — today, a TOTP app code from a contact identified by phone or email — before showing anything, with artifact downloads toggled per case or per session.
Public verification by token
Every session and every case carry a verification identifier independent from the internal ID — knowing it isn't enough to guess at other evidence.
Regulatory framework
Declared scope against UNE 71506
UNE 71506:2013 explicitly distinguishes the acquisition of «live systems» (§7.2 — Forensica's scenario) from that of «powered-off systems»/bit-by-bit cloning (§7.1) and from later forensic analysis (§9). The standard acknowledges that, on a live system, reproducibility isn't possible in the same sense as with cloning, and that «the validity of the results obtained largely depends on how they are justified in the expert report» — which is why recording the full session and documenting the procedure matters more, in this scenario, than any single stamping mechanism on its own.
Forensica covers, by design, the acquisition and custody of live systems — not the cloning of powered-off systems, mobile device extraction, or later forensic analysis; that remains the examiner's own work, with their own tools. The standard's own §1 clarifies that certifying software isn't its purpose: what could be accredited, if one wanted to go down that road, is the laboratory (ISO/IEC 17025), not the tool.
Evidence & public faith
Does this replace a notary?
No, and it isn't meant to. The evidence Forensica produces is technical evidence, freely assessed by a judge under Spanish civil procedure law (arts. 299 and 326 LEC) — it doesn't carry public faith ("fe pública"). If its authenticity is challenged, what sustains its validity is the expert report, backed by this same mechanism's technical guarantees: server-verified hash, dual timestamp, chained hash between artifacts, and a read audit log.
A notarial deed of fact-finding is different: carrying public faith, it produces full legal proof (art. 319 LEC) — much harder for the other party to challenge. When the case calls for it, or it's worth reinforcing the evidence with that extra presumption, a notary can act on evidence already captured with Forensica without having been present at the extraction — it's in fact one of the profiles already contemplated as a case contact (see the Partner program).
Roadmap
What's already there, and what's next
Implemented
- Server-side hash verification
- Dual RFC 3161 timestamp
- Per-session chained hash
- Local WORM storage
- Read audit log
- Private verification with 2FA (TOTP)
- Per-case/per-session download toggle
- Digitally signed reports (PAdES-T)
On the roadmap
- Qualified timestamp (eIDAS QTSP)
- Legal-entity signing certificate
- Cloud storage with Object Lock
- Formal retention policy
- AI assistant for case and evidence queries
- MCP server on the verification API
Technical questions?
We'll walk through the mechanism with you, in as much detail as you need
Bring your own technical or legal team along, if you'd rather.