An examiner asks why you allowed a deposit last year
Examiners rarely ask about the obvious cases. They pick an ordinary-looking one, because they are testing whether your process existed on that date and produced records at the time rather than afterwards.
Finding the case is the easy part. Since then your list data, your policy and the software have all changed, and the answer has to be about the day the decision was made rather than about today.
What happens
- The receipt names that day's inputs
It holds the policy version, the input hash and the content hashes of the list snapshots used in the comparison. The decision is reproducible because its inputs were recorded at the time, whether or not the current system happens to agree.
- Replay reproduces the decision
The same inputs under the same immutable policy version give the same result on demand. If a later policy would decide differently, that is visible as a difference between versions rather than hidden by one overwriting the other.
- The narrative is generated from the record
The plain-words section of the pack is derived from the same rows every time it is rendered, so it cannot drift from the evidence it describes. It is never stored beside the record as a second description of the same decision.
- The daily Merkle root makes later edits visible
Receipts are batched into a published root each day, and a record altered later no longer matches it. That is tamper-evidence. Whether the root also carries an independent third-party timestamp depends on configuration, and the attestations page says which batches have one.
What this does not do
Tamper-evidence is not proof of time by itself. A root published by KYTGate alone shows a record has not been altered since; independent dating requires RFC 3161 timestamps, and the per-batch state is published rather than assumed.
Replay reproduces the decision, not the world. If an external source answered differently that day and did not record why, the coverage matrix says the check did not answer.
Next
Questions
Then the original decision stands as correct on the data held at the time, and the re-screening that picked up the designation opens a new case with its own record. Both exist; neither overwrites the other.
Retention is configurable per tenant and applied by a scheduled job, and deletions are recorded. Set it to match your own regulatory obligation rather than ours.
One e-mail link gives you an isolated tenant and an API key. The screen that shows the key also shows a first call with a real listed address already in it. The sandbox includes fifty screenings a month on real data and is deleted after seven days.