When a shop seals a finished job, the record of that repair is frozen, fingerprinted and signed. This page says exactly what goes into it, when a job can be sealed, what sealing proves, and what it does not.
The photographs themselves are stored beside the record. What is sealed is each file's fingerprint, so the record says which photographs were there on the day it was sealed.
The record is written out in a fixed order and run through SHA-256. Change a single character, whether a price, a part or a date, and the fingerprint no longer matches.
The record is signed with an Ed25519 key held in the deployment environment, not in the database. Someone able to edit the database could recompute a fingerprint, but could not produce a signature to match it.
Each sealed record is linked to the one before it, so a record cannot be taken out of the chain or moved within it without the chain showing it.
The owner can publish the chain's current fingerprint through OpenTimestamps, which records it in the Bitcoin blockchain: no wallet, no fee, no token. From then on, the history up to that point cannot be rewritten, by the shop or by us, without the published fingerprint no longer matching.
Tamper-evident, not tamper-proof. No software can make stored data impossible to alter. What sealing guarantees is that an alteration shows: the fingerprint or the signature stops matching. That is a promise that can be tested, which a promise of prevention never is.
Sealed is not the same as published. A sealed record is the shop's own. Once the shop has accepted the publishing terms and been verified, its sealed repairs go onto the vehicle's permanent record on CarKnown once their invoices are paid in full, unless the customer has refused. Nothing about the customer and no money crosses; the privacy policy lists exactly what does.
A mistake is corrected with a new record. A sealed job cannot be edited, by the shop or by us. Correcting it means writing and sealing a new one, and the original stays as it was.
Imported history says it was imported. Past repairs brought across from another system are sealed too, dated to the day the work was done and marked as entered afterwards, so nobody mistakes them for records taken at the time.
Checking a record means asking us. Anyone with a record's id can ask, with no account, whether it is still intact, and see both fingerprints. That answer comes from our servers: it tells you what we found, not something you can confirm without us.
Say a shop replaces the front brake pads on a customer's SUV in October. The technician photographs the worn pads and the new ones, writes the pad thickness into the diagnosis, and marks the job Completed. At the counter, the job is sealed.
In March the customer calls to say the pads were never changed. The shop opens the sealed record. It shows the complaint in the customer's words, the diagnosis, the part fitted, who did the work, who sealed it and when, and a fingerprint for each photograph taken that day. Asked whether it is still intact, the check says it is: nothing in it has changed since October.
That does not settle the argument on its own. It does mean the shop argues from a record that was fixed before the argument began.
The demo shop walks one repair from intake to the seal, then asks the record whether it has changed. Sealed records are on every plan.