Digital fingerprints: how OPEREX proves a signed permit was not altered
How OPEREX shows that a signed permit, an approved risk assessment or a recorded action has been changed after the fact — and where the limits are.
In short
- Every signature on permits and maintenance work orders — and every risk assessment at approval — gets a digital fingerprint: the smallest later change can be detected.
- The signatures of a permit form a chain — editing, deleting or inserting a step breaks it, and the check says where.
- Every day, the fingerprints of the previous day’s audit trail, permit signatures and approvals are stored off-server, per organisation and chained.
- The QR code on a printed permit points to the organisation’s own address: a phone opens the live status without signing in — whether work may proceed on it now, and whether the paper is the latest version.
What is a digital fingerprint?
After an accident or an inspection, the first question is: is what we see now what was signed back then? A digital fingerprint gives a machine-checkable answer.
A digital fingerprint (technically: a cryptographic hash) is a short, unique string computed from the data by a standard procedure. OPEREX uses the internationally standardised SHA-256: data of any size yields a fingerprint of 64 characters.
When a record is signed or approved, the system computes and stores its fingerprint. A later check recomputes it from today’s data with the same procedure: if the two match, the data has not changed since; if they differ, the change has been detected.
23e71225 a1d8a5cf f685c7ea efb308d1db67ae2c fcfd32e7 88b6088e efcf418ff6a72616 44dafc3c 55727a7f 781ce67502c58167 04421e3e 03c0f388 83f89991Same data, same fingerprint
The same data yields the same fingerprint on every machine, every time — so the check can be repeated at any point.
Any change, a new fingerprint
Changing a single digit, accent or space gives a completely different fingerprint: a change cannot hide.
Cannot be reversed
The data cannot be recovered from the fingerprint, and in practice no other content can be made with the same fingerprint.
No secret involved
Computing it needs no key: anyone can recompute it. That makes it a check — not just the system’s claim.
Lock, chain, outside witness
A fingerprint detects a change but does not prevent it. So three layers work together: the lock prevents it, the chain detects it, and the outside witness records it beyond the server.
Lock — append-only records
The database refuses every role permission to modify or delete the audit trail and the signatures — including the owner account we operate with. Lawful, contractual deletion is an explicit, logged exception.
Chain — every step points to the previous one
Each permit signature stores the fingerprint of the previous signature — a new signature’s fingerprint also covers that link, the sequence number and the signing time — and the permit itself holds the last link and the number of signatures. Editing, deleting or inserting a step breaks the chain — and the check names the signature and the reason.
Outside witness — a daily fingerprint off-server
Every day, a per-organisation fingerprint of the previous day’s audit trail, permit signatures and approved risk assessments is stored off-server, each daily file pointing to the previous one. A later change to an already recorded day — even one made with owner rights inside the database — can thus be detected.
ae51…2f04…ae51…1549…2f04…1549…831e…1466…a9b5…The permit to work: every step is a signature
The permit is the most scrutinised document — after an accident it is the first thing to be pulled. Here all three layers work together, and the paper can be checked too.
- After the first signature — the request — the content of the permit cannot change. Every further step (issue, countersignature, acceptance, suspension, extension, closure…) is another signature in the chain.
- Each signature’s fingerprint covers the full content of the permit and the step itself: who did what, in which role, with which validity window.
- On the permit page both the server and the browser check the chain, stating their results separately. The evidence check reviews the permits and assessments of the accessible sites in one run; the report downloads as CSV and PDF, and the run itself is audited.
- A risk assessment is fingerprinted at approval (answers, prescription, the job safety analysis steps); from then on the database refuses any change to the approved content, and its own paper carries a QR code too.
https://example.operex.eu/e/5e1ea833aa7c63421ed792d6/1549262ce610c52bWhere the fingerprint works
The evidence fingerprints share one common implementation, with the same rule everywhere. Where a hash only measures copy integrity, we say so.
| Area | What the fingerprint records | Where it can be checked |
|---|---|---|
| AreaPermit to work | What the fingerprint recordsevery signature: the permit content and the step, chained | Where it can be checkedthe permit page · the paper’s QR (live status) · evidence and paper check · daily off-server fingerprint |
| AreaRisk assessment | What the fingerprint recordsthe approved content, at the moment of approval | Where it can be checkedthe assessment page · evidence and paper check · daily off-server fingerprint |
| AreaMaintenance work order | What the fingerprint recordsthe handover, test and acceptance signatures, chained | Where it can be checkedthe work order page |
| AreaAudit trail — every module | What the fingerprint recordsevery recorded action of the day per organisation, the shift log’s too | Where it can be checkeddaily off-server fingerprint — comparable with the live database to the day and organisation |
| AreaExit and deletion | What the fingerprint recordsevery exported file, the file inventory and the deletion certificate | Where it can be checkedby the recipient, on their own machine (SHA-256 per file) |
| AreaBackup | What the fingerprint recordsthe backup uploaded off-server | Where it can be checkedintegrity check: is the copy intact — not tamper protection |
What we do NOT claim
- No machine authenticates the text on the paper. The QR says what the permit’s current state is and which version the sheet was printed from; whether the paper says the same is compared by a person against the title, location and status on the live page — a genuine QR code can be copied onto a forged sheet.
- The live status is shown without signing in, but only with network coverage (without it, ask the issuer). The per-signature chain check, the evidence report and checking old text QRs require signing in with view rights.
- The daily off-server fingerprint is made the next day — until then, the day’s data is protected by the lock and the chain.
- The outside witness detects a later change made inside the database; protection against a full takeover of the server does not come from it.
- A signature is a recorded step by a user identified in the system (signed in, with two-step verification depending on the organisation’s settings) — not a qualified electronic signature.
We are happy to demonstrate the checks on a live system — including when preparing for an audit or a procurement questionnaire.
The full brief as PDFFurther reading
Frequently asked questions
What is a digital fingerprint (hash)?
A short, unique string computed from the data by a standard procedure — OPEREX uses SHA-256, which yields 64 characters from data of any size. The same data always gives the same fingerprint, the smallest change a completely different one, and no key is needed to compute it: anyone can recompute it.
How can you tell that a signed permit to work was not altered afterwards?
Each signature’s fingerprint covers the full content of the permit and the step itself (a new signature’s also the chain link, the sequence number and the signing time); each signature stores the fingerprint of the previous one, and the permit holds the last link and the number of signatures. The check recomputes them: editing, deleting or inserting a step breaks the chain, and the check names the signature and the reason.
What does the QR code on a printed permit prove?
The QR is a link to the organisation’s own address: a phone opens the permit’s live status without signing in. The first sentence is the verdict — may work proceed on it right now (active, within the validity window, with an intact chain) — and the second says whether the paper is the latest version or how many changes happened since. No personal data is shown, and the code is not the permit number but a random identifier. Older papers with a text QR can still be checked on the paper check page. No machine authenticates the text on the paper — a person compares it with the data shown on the live page.
What protects against a retroactive rewrite inside the database?
Every day, a per-organisation fingerprint of the previous day’s audit trail, permit signatures and approved risk assessments is stored off-server, each daily file pointing to the previous one. A later change to an already recorded day — even one made with owner rights — can thus be detected. Protection against a full takeover of the server does not come from it.
Is a signature recorded in OPEREX a qualified electronic signature?
No. A signature is a recorded step by a user identified in the system — signed in, with two-step verification depending on the organisation’s settings — protected by the fingerprint chain and the database lock.
Which modules use the fingerprint?
The permit to work (every signature, chained), the risk assessment (the approved content), the maintenance work order (the handover signatures, chained), the audit trail — of every module, the shift log’s too, with a daily off-server fingerprint —, the export at exit (SHA-256 per file) and the integrity check of backups.
Let's start a pilot
We'll show you OPEREX on your own operational processes — no strings attached.
Request a demo