Feature · Evidence
Each test gets a pass/fail verdict signed by the tester, with its evidence bound to it. The log is append-only and tamper-evident — actor, content, and time fixed at the moment of capture — so the day an auditor asks, you export instead of reconstruct.
Availability · Free forever — the signed, immutable evidence log is included on the desktop app.
The problem
Pasted images can be cropped, re-dated, or quietly swapped. A spreadsheet of pass/fail can be edited by anyone after the fact, with no trace. When the integrity of your test record matters — and in regulated software it always does — "trust us, this is what happened" doesn’t hold up.
How it works
When a tester attests a session, the verdict is signed and the evidence behind it is bound in. Actor, content, and time are fixed together — not added later, not editable after the fact.
Records are added, never silently overwritten. If anything in a sealed record were altered, it would show. The history of what was tested, by whom, and what they saw stays intact.
Each record carries a content hash, so the evidence can be verified as the exact bytes that were signed. Integrity is something you can check, not something you have to take on faith.
Append-only, attributable, time-stamped records are the shape of evidence that regulated environments expect — the same properties teams need when they work toward FedRAMP, CMMC, 21 CFR Part 11, or IEC 62304 review.
Where it fits
Signing turns raw session capture into something durable. From there, signed records roll up into the self-building traceability matrix (audit export) and remain the source of truth a coding agent reads when it acts on a failure (agent-ready context).
FAQ
Once a record is signed it isn’t silently overwritten — new information is added as new records, and the original stays intact. Any change to a sealed record is detectable, which is what makes the log tamper-evident.
Yes. The signed, immutable evidence log is part of the free desktop app. Cloud plans add shared storage, traceability, and audit-package export across a team.
No. Microfilm produces signed, append-only, time-stamped evidence that fits how regulated environments expect records to behave. Certification of your overall system is your organization’s responsibility; Microfilm gives you the evidence trail to support it.
Each record is content-addressed by a hash of its evidence, so the bytes that were signed can be checked against the bytes you hold — integrity you can verify rather than assume.
Create a workspace for your team, or download the free capture app and record your first session.