Spark — audit-log transparency

Each tenant's per-tenant audit_log is a SHA-256 hash chain (Merkle-style). Velocity-EU publishes the chain root of each tenant weekly, signed by the Velocity-EU Spark Intermediate CA. Any auditor — including the tenant itself — can recompute the root from the underlying audit-log rows and check it against the value published below.

How to verify locally

  1. Pull every row from your tenant's audit_log where chain_seq IS NOT NULL, in order.
  2. Concatenate every row's this_hash column (32 raw bytes per row, in chain_seq order).
  3. Compute SHA-256 of the concatenation. That's your computed root_hash.
  4. Compare to the root_hash column below. Mismatch ⇒ tamper or out-of-date publish.
  5. If the signature column is non-empty: verify it against the Spark intermediate CA cert at https://sparkfe.co.uk/.well-known/spark-intermediate-ca.pem.

Latest published roots

TenantSealed seqroot_hash (hex)SignaturePublished
ACME College
acme
172209e192675c56c313d39b67be50caf8fb67f6a33cbe278f913dd499d09d9bb0a1unsigned2026-09-21T06:00:20.63+00:00
BELL College
bell
0e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855unsigned2026-09-21T06:00:20.63+00:00
E2E College
e2e
—(never published)unsigned—

PRD §2.8.4 — audit-chain transparency. Velocity-EU sub-processor list at /legal/dpa. Issues with this page? support@sparkfe.co.uk.