Everything that has ever happened on this account.
A permanent, append-only ledger: every order, every check-in, every bushel, every notification sent and every consent given or withdrawn, with a timestamp on each. Nothing in it can be edited, including by us.
The last twelve entries.
Append-only. Entries are never edited or removed, including by us, and a correction is a new entry referring to the old one rather than an overwrite.
RecordAccount record · illustrative
-
30 Aug, 09:14
Check-inThe farm shop · 40 bushels at the doubled rate
You
a41c9e -
28 Aug, 18:02
Notification sentBox shipping in three days · push and email
System
77b2d0 -
26 Aug, 07:03
Notification sentThe combine is moving · push and SMS · outside quiet hours
System
1f9a44 -
26 Aug, 06:58
Crop stage filedPatch B2 · ready to cut · moisture 17.4%
C. Ireland
e0c318 -
19 Aug, 11:40
Order placedTwo jars, one tea towel · £18.50 · 18 bushels
You
5b7e21 -
14 Aug, 16:22
Bad news sentThe durum has come in short · substitution policy triggered
System
c93f70 -
03 Aug, 09:00
Box dispatchedThe Larder Box, August · 25 bushels
System
2d6ba9 -
28 Jul, 21:11
Consent withdrawnMarketing email · recorded permanently
You
8ae512 -
14 Jul, 12:35
Bushels spent850 · one jar of Bee Juice · balance 3,206
You
4c1d88 -
02 Jul, 08:00
Cask return filed#0231 · quarterly · 63.1% · no leakage
The warehouse
b60f37 -
21 Jun, 19:44
Badge earnedMy barley is now beer · batch 0114
System
9e4a02 -
12 Jun, 10:07
Address changedDelivery address updated · previous one retained seven years
You
f3820c
The short code on each row is a content hash of the entry. It is there so that an entry cannot be quietly rewritten later without the code changing.
Why it is append-only.
Because the alternative is a record we can edit, and a record the operator can edit is not evidence of anything. It is a display.
Every entry carries a hash of its own contents. Changing an entry changes its code, and the codes are chained, so changing one changes every one after it. That does not make it tamper-proof — we could still rewrite the lot — but it makes tampering visible to anybody who wrote down a code, which is a substantially better position than trust.
The practical consequence is that mistakes are corrected by adding a line rather than by removing one. There are eleven correction entries in the demonstration record and every one of them is legible.
What goes into it, and what does not.
| Recorded | Not recorded |
|---|---|
| Every order and every line on it | What you looked at and did not buy |
| Every check-in, with the site | Where you were when you did it |
| Every bushel earned and spent | Anything about your card |
| Every notification we actually sent | Whether you read it |
| Every consent given and withdrawn | Why you withdrew it |
| Every crop stage filed against your patch | The agronomist’s opinion of the field |
| Every correction, as a new line | Any deletion of an old line |
Append-only
Nothing is edited or removed, and corrections are new lines.
Hashed and chained
Changing one entry changes every code after it.
In the export
The whole record, as a file, whenever you want it.
Kept seven years
Alongside the orders, because it is attached to them.
The record, questioned.
No, and neither can we. Closing the account detaches the record from you and anonymises what tax law requires us to keep; it does not rewrite history.
We add a correcting entry that refers to it. Both stay visible, which is the only honest way to correct a ledger.
No. It is a hash chain in an ordinary database, which is the useful ninety per cent of the idea without the rest of it.
Nobody. It is yours, it is in your export, and it is not shared with anyone.
The honest version, fortnightly
No campaign calendar, no filler. When there is nothing to say we do not send anything.
