Comparison
Evidence chain vs. log file
Log files document what a system says about itself — one-sided, changeable, contestable in a dispute. An evidence chain documents what both sides have signed — hash-chained, timestamped, mathematically checkable for tampering.
| Dimension | Evidence chain (Evidence Vault) | Classic log file |
|---|---|---|
| Parties | Signed by principal and verifier — even when both sit in the same company | One-sided: the logging system vouches for itself |
| Tamper detection | Hash chain: every change breaks the following hashes | Organisational (access control) |
| Proof of time | Qualified eIDAS timestamps prepared (presumption once a QTSP is connected) | Server clock |
| Usability | Audit export for disputes, supervisors, insurers | A question for an expert witness |
Verdict
Logs are enough for operations; not for the question of liability. As soon as agents act with external effect, the quality of the evidence decides who can prove what in a dispute — and who pays.