How carseal proof works
A carseal scan becomes evidence in five steps: the photos are hashed, the hashes are combined into a single Merkle root, that root is signed by carseal's server, the signed root is sent to an independent RFC-3161 timestamp authority, and the whole package is written into an append-only custody log. The result is a record where changing any pixel of any photo changes the root — which no longer matches the signature or the timestamp. Anyone can check that for themselves with the verify link, without an account and without asking us.
Step 1 — every photo is hashed on its own
SHA-256 per photo
When a scan finishes, each kept photo is run through SHA-256, producing a 64-character fingerprint. Change one pixel and the fingerprint changes completely. The fingerprint is not reversible — it says nothing about the photo's content, only that this exact file produced it.
Frame selection runs on the phone, so only the sharpest kept frames are uploaded at all. Every one of them arrives with its own hash.
Step 2 — the hashes are folded into one Merkle root
A Merkle tree over the scan
The photo hashes become the leaves of a Merkle tree. Pairs are concatenated and hashed together, then those results are paired and hashed again, layer by layer, until a single hash remains: the Merkle root. (When a layer has an odd number of nodes, the last one is duplicated so it can still pair.)
This is the step that makes the scan tamper-evident as a set. One root commits to every photo at once, so a later swap, deletion or reordering of any single photo produces a different root. It is the same construction Bitcoin and Certificate Transparency logs use, for the same reason.
Step 3 — carseal signs the root
Server signature
The Merkle root is signed with carseal's server private key. The signature says the root was produced by carseal's pipeline and not assembled afterwards by whoever is holding the file.
Step 4 — an independent authority timestamps it
RFC-3161 trusted timestamp
The signed root is sent to a third-party timestamp authority, which returns a signed token under RFC 3161 — the same standard used for code signing and legal e-archiving. The token attests that this exact root existed at that moment in time, and it comes from someone with no stake in your rental dispute.
This is the part that matters in an argument. carseal saying "this photo is from Tuesday" is a claim by an interested party. An independent timestamp authority saying "this fingerprint existed on Tuesday" is not.
Being precise: the timestamp is requested from an external service, so when that authority is unreachable the package is still sealed, signed and logged — just without a third-party token for that scan. The certificate shows whether a trusted timestamp is present rather than assuming one.
Step 5 — the package is logged, append-only
Custody log
The sealed package — root, signature, timestamp token and the photo manifest — is written to the evidence record, and a SEALED entry is appended to the inspection's custody log. The log is append-only: later events are added, never edited over the top of earlier ones, so the record's history stays readable.
How anyone can check it
Every Return Certificate carries a public verify link and a QR code. Opening it re-derives the Merkle root from the stored manifest and checks it against the signature and the timestamp token. A rental company, a bank's dispute team or an insurer can do this themselves, with no carseal account and no request to us.
The verify page confirms that a sealed record exists and is internally consistent — it does not expose your photos to whoever opens the link. You decide who receives the certificate itself.
Why the before/after comparison is fail-closed
At return, a second scan is compared against the pickup scan panel by panel. The comparison is deliberately biased in the renter's favour: where the evidence is ambiguous, damage is treated as pre-existing rather than new. A system that guessed "new" when unsure would occasionally manufacture exactly the accusation carseal exists to defend against.
That trade-off is the whole design. It means carseal will sometimes decline to call something new damage that genuinely is — and that is the correct error to make.
What this does not claim
carseal proves when a set of photos existed and that they have not changed since. It does not prove who caused a mark, and it is not a legal ruling. What it does is remove the part of the argument that renters normally lose: whether the damage was there before you drove away.
Next: what it costs, or how to dispute a damage charge if you are already being charged.