Any database, however well administered, can be changed by someone with sufficient access. That includes the honest administrator running a migration and the attacker who found the credentials. The question is not whether records can change, but whether a change can be detected.

When a record enters a SabiProfile vault, we compute its SHA-256 hash and commit that hash, with a timestamp, to a smart contract on an EVM network. The contract does one thing: it remembers hashes. It cannot be edited retroactively, and it does not depend on our servers being honest.

Verification then becomes a recomputation. When an enterprise queries a candidate, the Integrity Agent hashes the record it was just handed and compares it to the on-chain anchor. One flipped character anywhere in the record produces a completely different hash, the comparison fails, and the screening pipeline stops before any AI evaluation runs.

We chose a low-cost L2 network for this deliberately. Anchoring a hash costs fractions of a cent, which makes it practical to anchor every record rather than a sample. Tamper-evidence that only covers one record in a thousand is a brochure, not a control.