Tamper-evident monitoring · anchored on BSV

Prove what happened on your servers.

Security teams can detect incidents. CERTIHASH preserves evidence. Every observation is cryptographically chained, signed by the host, and anchored to a public blockchain so the record can still be trusted months later.

Request a pilot → See how verification works
Designed for evidence. Not promises. Not screenshots. Not “trust us.”
certihash verifier 
$ curl -fsSLO https://app.certihash.live/downloads/certihash-verify.mjs
$ curl -fsSLO https://app.certihash.live/downloads/certihash-verify.mjs.sha256
$ shasum -a 256 -c certihash-verify.mjs.sha256 || sha256sum -c certihash-verify.mjs.sha256
certihash-verify.mjs: OK
$ node certihash-verify.mjs proof.json --issuer app.certihash.live

✓ EVENT_HASH_MATCHES
✓ EVENT_IN_BATCH_ROOT
✓ AGENT_SIGNATURE_VALID
✓ BATCH_IN_TENANT_ROOT
✓ ROOT_IN_ONCHAIN_OPRETURN
✓ ORG_SIGNATURE_VALID
✓ ORG_KEY_PINNED
✓ ANCHOR_IN_BLOCK

anchored in block 967922
at 2026-09-22T20:10:38Z
VERIFIED 8 independent checks passed
What Sentinel Node does

Your security record becomes evidence.

CERTIHASH records changes to declared files, directories, accounts, startup state, SSH access and logs — then seals the resulting evidence so alteration is visible.

01

Records change

Monitor the files, directories and logs that matter, instead of attempting to capture everything indiscriminately.

02

Proves integrity

Each record is hashed, linked to the one before it, and signed. Delete or alter something later and the chain exposes the break.

03

Anchors publicly

Merkle roots are written into Bitcoin transactions, giving the evidence a timestamp and an external point of reference you do not control.

How it works

Four stages. One independently checkable chain.

01 / WATCH

Watch

A lightweight agent watches declared system surfaces. Ready-made policies cover ordinary Linux servers.

02 / CHAIN

Chain

Each observation is hashed, linked to the prior record, and signed by the host that created it.

03 / ANCHOR

Anchor

Chains are folded into Merkle roots and committed on-chain on the schedule your organisation chooses.

04 / PROVE

Prove

Export a portable proof for a single event: the record, signatures, Merkle path and blockchain anchor.

Independent verification

Check it without asking us.

The verifier does not quietly convert uncertainty into success. A check that cannot run is reported as unable to run. An unpinned key is never counted as verified.

“The value of a security record is decided by whether a stranger can believe it.”

Proofs can be checked offline, against a block-header source you choose, with signing keys resolved independently from the issuer’s own domain.

L1
Event integrity
Record hash matches the evidence
PASS
L2
Agent authenticity
Host signature validates
PASS
L3
Merkle inclusion
Event resolves into batch and tenant root
PASS
L4
Organisation identity
Issuer signature and key pinning validate
PASS
L5
Public anchor
Committed root is found in the referenced block
PASS
Privacy by architecture

Your logs do not have to leave your host.

CERTIHASH seals hashes of byte ranges rather than shipping log contents to a third party. That distinction matters on systems holding data that cannot simply travel.

Not an IDS

It does not claim to stop the attack.

Firewalls, EDR, SIEM, IAM and intrusion detection all have different jobs. CERTIHASH addresses what happens after: proving what changed, and whether the record itself remained intact.

Portable proof

Evidence survives beyond the dashboard.

A proof can be exported as a file and checked later by an auditor, regulator, customer, insurer, investigator or court, without relying on access to your internal console.

Where this came from

Enterprise security roots. Rebuilt from the ground up.

Sentinel Node was announced in 2022 as the first of a planned suite of enterprise security applications aligned with the NIST cybersecurity framework, developed with IBM Consulting on software design and development. The platform has since been rebuilt around one enduring principle: evidence should remain believable even when the party presenting it is not trusted.

Read the original announcements →

Pilot programme

Deploy it where proof actually matters.

We are placing a small number of free, time-boxed pilots with organisations that periodically need to demonstrate what changed on their systems — to an auditor, regulator, customer, insurer, investigator or court.

Request a pilot →