How carseal proof works
A carseal scan is packed in five steps: the photos are hashed, the hashes are combined into a single Merkle root, that root is signed by carseal's server, the signed root may be sent to an RFC-3161 timestamp authority, and the package is written into an append-only custody log. Changing a stored photo would change the root. The public page currently re-checks that stored hash record — not live file bytes, and not that the AI assessment is complete or correct.
Step 1 — every photo is hashed on its own
SHA-256 per photo
When a scan finishes, each kept photo is run through SHA-256, producing a 64-character fingerprint. Change one pixel and the fingerprint changes completely. The fingerprint is not reversible — it says nothing about the photo's content, only that this exact file produced it.
Frame selection runs on the phone, so only the sharpest kept frames are uploaded at all. Every one of them arrives with its own hash.
Step 2 — the hashes are folded into one Merkle root
A Merkle tree over the scan
The photo hashes become the leaves of a Merkle tree. Pairs are concatenated and hashed together, then those results are paired and hashed again, layer by layer, until a single hash remains: the Merkle root. (When a layer has an odd number of nodes, the last one is duplicated so it can still pair.)
This is the step that makes the scan tamper-evident as a set. One root commits to every photo at once, so a later swap, deletion or reordering of any single photo produces a different root. It is the same construction Bitcoin and Certificate Transparency logs use, for the same reason.
Step 3 — carseal signs the root
Server signature
The Merkle root is signed with carseal's server private key. The signature says the root was produced by carseal's pipeline and not assembled afterwards by whoever is holding the file.
Step 4 — an independent authority timestamps it
RFC-3161 timestamp token
The signed root is sent to a third-party timestamp authority, which may return a signed token under RFC 3161. The token, when present, attests that this hash existed at that moment. carseal does not yet independently validate the token in-app.
This is the part that matters in an argument. carseal saying "this photo is from Tuesday" is a claim by an interested party. A timestamp authority token, when one exists, is additional corroboration — not a court ruling, and not yet validated inside the app.
Being precise: the timestamp is requested from an external service, so when that authority is unreachable the package is still sealed, signed and logged — just without a third-party token for that scan. The certificate shows whether a trusted timestamp is present rather than assuming one.
Step 5 — the package is logged, append-only
Custody log
The sealed package — root, signature, timestamp token and the photo manifest — is written to the evidence record, and a SEALED entry is appended to the inspection's custody log. The log is append-only: later events are added, never edited over the top of earlier ones, so the record's history stays readable.
How the public check page works
Every Return Certificate carries a public link and a QR code. Opening it re-derives the Merkle root from the stored manifest and checks it against the stored signature and timestamp token, if any. It does not hash live file bytes from storage, and it does not prove the AI assessment is complete or correct.
The page does not expose your photos to whoever opens the link. You decide who receives the certificate itself.
Why the before/after comparison is fail-closed
At return, a second scan is compared against the pickup scan panel by panel. Where the evidence is ambiguous, damage is treated as pre-existing rather than new. That does not mean every new mark is found, and missing coverage is not a clean bill of health.
That trade-off is the design: it is better to decline to call something new than to invent an accusation. Hidden, poorly lit or uncovered marks can still be missed.
What this does not claim
carseal records when a set of uploaded photos was hashed and that the stored hash record is internally consistent. It does not prove who caused a mark, that every mark was photographed, or that a court or issuer must accept the file. Independent byte and signature verification is not yet available.
Next: what it costs, or how to dispute a damage charge if you are already being charged.