Forensic Continuity
When a decision is questioned months later, an institution needs to show what was decided, why, and that the record has not been changed since. QUORUM records every decision before releasing it and links it to a signed, hash-chained ledger that a third party can check.
Verdict, score, fired rules and flags, the institution's reference, the time, and a SHA-256 digest of the inputs. The raw inputs are not stored in the record, which keeps card numbers and personal data out of the evidence chain.
Within seconds the record is placed under a Merkle root that is written to the hash-chained audit ledger, signed with Ed25519 and ML-DSA-65, and — when configured — timestamped by an RFC 3161 authority.
For every real-time block: each fired rule's contribution, the score and verdict had that rule not fired, and the smallest set of rules whose absence would change the verdict. Signed and stored against the decision ID.
Where a case is reviewed by the asynchronous AI tiers, their verdicts carry keyed HMAC integrity receipts so later alteration is detectable. These are evidence for analysts, not part of the real-time decision.
A decision proof links the record to a signed ledger entry, and the RFC 3161 token (if configured) dates it.
Recompute the record hash, walk the Merkle path and check both signatures. Any change breaks the chain.
If the institution keeps the original request in its own systems, hashing it reproduces the digest in the record.
The fired rules in the record and the signed counterfactual certificate.
A Bulletproofs zero-knowledge proof shows the score was within stated bounds without disclosing it.
Alteration of an anchored entry is detectable without trusting QUORUM. The ledger lives in PostgreSQL, so it is not immutable; restrict write access and archive anchored roots outside the database.
A verdict that cannot be recorded is not issued, so there are no unrecorded decisions to explain later.
Decision records do not yet carry a hash of the active rule set, so re-running a past decision against its exact rule version is a planned addition, not a current capability.