Tamper-Evident Integrity Reports: Why Signed Evidence Matters
An integrity finding can change someone's career. That raises the bar: the record behind a decision has to be something nobody can quietly edit afterwards, not the company, not a disgruntled reviewer, not an attacker. Cryptographic signing is what makes a report trustworthy after the interview ends.
Short answer
An unsigned report proves nothing about itself. Signing runs the finished report through a cryptographic hash, producing a fingerprint that changes completely if a single character changes, then signs that fingerprint with a private key. Anyone holding the public key can re-hash the document and confirm it is byte-for-byte the original.
This matters most at the moment it is tested: a candidate appeal, an internal escalation or a compliance review, months after everyone involved has forgotten the session.
On this page
- The problem with an ordinary PDF
- How signing makes tampering visible
- What belongs inside the signed payload
- What it means in practice
- Why HR, legal and security care
- How signed evidence protects candidates
- Keep summaries and evidence separate
- Minimum workflow requirements
- Where verification should happen
- Frequently asked questions
The problem with an ordinary PDF
A normal report is just a file. It can be re-saved, re-worded or back-dated, and no third party can tell. If a candidate appeals, or HR and legal need to rely on the record months later, "trust us, we did not change it" is not good enough, particularly when the party asking to be trusted is also the party that made the adverse decision.
The problem is not that people routinely falsify hiring records. It is that an unsigned record cannot distinguish between an organisation that did and one that did not, so the honest organisation gets no benefit from its honesty.
How signing makes tampering visible
When a report is finalised, its contents are run through a hash function, producing a compact fingerprint that changes completely if even one character is altered. That fingerprint is signed with a private key. Anyone can later re-hash the report and check the signature against the public key: if they match, the report is byte-for-byte the original; if they do not, it has been changed.
Two properties are doing the work. The hash is sensitive: changing one character produces a completely different fingerprint, so partial tampering is not possible. The signature is asymmetric: verifying requires only the public key, so a candidate or a regulator can check the report without being given any capability to produce one.
What belongs inside the signed payload
Signing the wrong scope is a common mistake. A signature over the summary page alone proves very little, because the summary is exactly the part someone would want to revise.
| Element | Why it is bound in | Inside the signature? |
|---|---|---|
| Session identifier | Ties the report to one specific interview event. | Yes |
| Monitoring start and stop | Proves the collection window matches what was disclosed. | Yes |
| Consent timestamp | Shows consent preceded collection, not the reverse. | Yes |
| Signal timeline | The evidence itself, with per-event hashes. | Yes |
| Computed score and weights | Lets anyone recompute the number from the same events. | Yes |
| Human review notes | Written after the fact and legitimately revisable. | No, stored alongside |
| Final hiring decision | Changes through the process and belongs to the ATS record. | No, stored alongside |
The split in the last two rows matters more than it looks. If review notes live inside the signed payload, then every legitimate addition of a reviewer comment either invalidates the signature or forces a re-sign, and a record that gets re-signed routinely provides no assurance at all.
What it means in practice
- Independent verification. A third party can confirm authenticity without taking your word for it, which is the entire point.
- Defensible decisions. The integrity record stands up in an appeal or an audit because its provenance is checkable.
- No silent edits. Altering a single line invalidates the signature, so tampering is detectable even if not attributable.
- Chain of custody. The verdict, its evidence and its timing are sealed together, so nobody can later pair an old score with a new timeline.
Why HR, legal and security care
Interview integrity reports are not recruiter notes. They can become evidence in an internal escalation, a candidate appeal, a discrimination claim or a compliance review. If the underlying document can be quietly revised, confidence in the whole process collapses, and the organisation loses the ability to demonstrate that it treated two candidates consistently.
A signed report should prove more than that a file existed. It should prove which session produced it, which events were included, when it was generated, and whether the contents changed afterwards. In a dispute a hiring team may need to show that the report was not edited after the rejection, that the candidate consented before monitoring began, and that the events used in review came from the original session. An ordinary PDF cannot establish any part of that chain on its own.
Key takeaways
- A plain report can be edited with no trace; signed evidence cannot.
- Hashing plus signing lets anyone detect a single-character change, using only the public key.
- Sign the evidence and the consent and collection timestamps; keep revisable review notes outside the signature.
- Reports become independently verifiable rather than "trust us".
- Tamper evidence protects candidates as much as employers, by forcing decisions to rest on captured evidence.
How signed evidence protects candidates
Tamper evidence is usually sold as protection for the employer, and it is, but the candidate-side benefit is the stronger argument. If reviewers cannot quietly edit a report after the fact, the decision has to stand on the actual session evidence. That discourages vague accusations, discourages retrospective justification, and encourages teams to document their reasoning at the time rather than reconstructing it under pressure later.
It also gives a candidate contesting an outcome something concrete to examine. "We observed unusual activity" is unfalsifiable. A signed timeline showing four specific events with timestamps is something a person can actually respond to, including by explaining an event the reviewer misread.
Keep summaries and evidence separate
A report has two kinds of content with two different lifecycles. The evidence is fixed at the moment the session ends. The interpretation continues to develop as reviewers, hiring managers and sometimes legal add their judgement.
Referencing the signed payload by hash from the annotation layer is what keeps the two bound without merging them. A note that cites a hash which no longer verifies is itself a signal that something is wrong.
Minimum workflow requirements
- Unique session identifierTied to the candidate and the interview event, so a report can never be silently reassociated with a different session.
- Timestamped event timeline with stable per-event hashesSo individual events can be cited and verified without disclosing the whole report.
- Consent and monitoring timestamps inside the payloadProving collection began after disclosure, which is the first question any regulator asks.
- Readable verification statusReviewers should see whether a signature is valid without specialist tooling or an engineering ticket.
- Controlled storageThe signed report attaches to the record that actually drives the hiring decision, not to an inbox.
- Defined retentionState how long signed reports are kept and delete them on schedule. Indefinite retention of adverse findings is its own liability.
Where verification should happen
Verification that requires engineering involvement will not happen. Recruiting operations, HR, legal and security all need to check a report during ordinary work, so the verification result should be visible in the interface that holds the record, rendered as plainly as possible: valid, or not valid, with the time of the check.
Independent verification should also be possible from outside, using a published public key, for the cases that matter most: a candidate appeal or an external audit. If the only party who can verify a report is the party who issued it, the signature is decorative.
Signing is what turns an explainable integrity score into evidence you can rely on later. It is the final link in a programme built on consent, correlation and accountability.
Frequently asked questions
Why does an interview integrity report need a digital signature?
Because an integrity finding can change someone's career, and an unsigned file proves nothing about itself. A normal PDF can be re-saved, re-worded or back-dated with no trace, so the only assurance it offers is the issuer's word.
A signed report lets a candidate, an HR reviewer, a regulator or a court confirm independently that the document is byte-for-byte what was produced at the time, without needing to trust the company that produced it.
How does tamper-evident signing actually work?
The finished report is run through a cryptographic hash function, which produces a short fingerprint that changes completely if even one character of the input changes. That fingerprint is then signed with a private key held by the issuing system.
Anyone with the corresponding public key can re-hash the report and check it against the signature. If they match, the report is unaltered. If they do not, something changed, and the check fails without needing to identify what changed.
What should be included inside the signed payload?
Bind together everything a later reviewer needs to reconstruct the decision: the session identifier, the candidate and interview references, monitoring start and stop timestamps, the consent timestamp, the full signal timeline with per-event hashes, and the computed score.
Human review notes should be stored alongside the signed payload rather than inside it, so that adding an interpretation later does not require re-signing the underlying evidence or invalidate it.
Does signing a report make it legally admissible?
Signing establishes integrity, meaning the document has not changed since it was produced. That is necessary but not sufficient for admissibility, which also depends on jurisdiction, on how the evidence was collected, on whether monitoring was lawfully disclosed, and on the chain of custody around the record.
Signing removes one common objection, that the record could have been edited after the outcome was decided. Employers should still take legal advice on their own process.
Does tamper-evident reporting protect candidates or only employers?
Both, and the candidate benefit is often underrated. If reviewers cannot quietly revise a report after a rejection, the decision has to stand on the evidence actually captured during the session.
That discourages vague after-the-fact justification, forces teams to document reasoning at the time, and gives a candidate contesting an outcome something concrete and verifiable to examine rather than an unfalsifiable summary.
Who should be able to verify a signed integrity report?
Verification should not require engineering involvement. Recruiting operations, HR, legal and security all need to check a report's status during ordinary work, so the verification result should be visible in the interface holding the record.
An independent check should also be possible from the published public key without special tooling. If verifying requires filing a ticket, nobody will verify anything and the signature becomes decorative.
References
- Designing a fair interview integrity score, on the score a signature seals.
- Consent-first interview monitoring, on the consent timestamp bound into the payload.
- Integrity reports, for how InterviewWatch generates and signs them.
- Security, for key handling and retention.
Evidence that holds up
Every InterviewWatch report is cryptographically signed, so any later edit is detectable by anyone, without trusting us.