Who did what, under which purpose, and proof that the record was not altered.

Security software is trusted only as far as its use can be checked. In September 2026 the Internet Freedom Foundation reported that a police facial-recognition sweep listed 2,873 people at protest sites on an 80% match threshold, with no statute or retention limit behind it (IFF, 4 Sep 2026). Records that cannot be audited invite exactly that.

The law is catching up. CERT-In has required Indian organisations to keep ICT logs for 180 days in India since 2022 (CERT-In). The DPDP Rules, notified on 14 November 2025, bring security, logging and erasure duties into force by May 2027, with penalties up to ₹250 crore for failing to protect personal data (PIB).

• Writes every operator action to an append-only chain in which each entry carries the SHA-256 of the one before. Any edit, deletion, insertion or reordering breaks the chain at that point.
• Every 16 entries records a Merkle checkpoint. Roots published outside the system catch even a complete rewrite, and a single entry can be proved inside a checkpoint with a few sibling hashes.
• Decides each request from one policy file: role, declared purpose with a ticket that expires, data class and action, with a trace of every check. Identifiable personal data is always denied; filters by religion, caste, ethnicity, language or origin are refused.
• Requires a second, independent approver for copies of sensor tracks, person-level searches and sharing outside the organisation. Attempts to bypass the rule are logged.
• Deletes data on a published schedule unless a legal hold applies, and writes a receipt with a Merkle root over the deleted ids.
• Scans every public data file for phone, Aadhaar-like and PAN numbers, email addresses, unmarked person records and person risk scores, and reports them masked.
• Scores the weather forecasts behind the heat, cold, road and patrol advisories against what airports near the frontier reported, one to seven days ahead, and records each check in the ledger.
• Publishes a model and data card for every product and a public transparency report.

1. Canonical formEach entry is serialised by RFC 8785 so Python and a browser hash identical bytes.
2. Chainhash = SHA-256 of the entry, which includes the previous entry's hash.
3. CheckpointAn RFC 6962 Merkle root over all earlier entries, every 16 entries.
4. AnchorRoots published on the transparency page and in git history, where the writer cannot change them.

The same rules run in Python and in the browser, and the test suite holds them to identical results on shared vectors, every tamper case and all 1,008 policy combinations. The full method, legal basis and failure modes are in the public methods note.

SAKSHI reads platform metadata, plus public airport reports and archived forecasts for the forecast check. It never stores record contents in the chain: entries hold references, counts and hashes.

• Oversight and audit officers: verify the record of who did what, and test whether a request should have been allowed.
• Data protection officers: retention, erasure receipts and a personal-data scan of everything published.
• Courts and inquiries: an evidence trail whose integrity can be shown with a few hashes, without trusting the operator.
• Commanders: a second key on the actions that matter, with the reason written down.

• The chain stores references, never personal data: the API refuses entries carrying a mobile number, an Aadhaar number or an individual PAN, the browser masks such numbers and email addresses before sealing, and query text is kept only as a hash.
• Approval state is rebuilt from the chain and every step re-checked, so an approval cannot be forged without breaking the chain.
• The scan report never repeats what it found: numbers are masked to their last four digits and names to initials.
• Oversight findings are advisory. Decisions about people rest with accountable officers; nothing here acts against anyone automatically.

• A hash chain alone can be rewritten end to end by whoever holds it. Detection of that needs anchors kept elsewhere, and auditors should keep their own copies.
• The policy checks declared purposes and tickets; it cannot know whether a declaration is true. The audit chain and the oversight officer are the check on that.
• The scanner finds patterns. Names in free text are caught only when they also appear as person records or after S/o, D/o or W/o; images and PDFs are out of reach.
• In the browser the chain lives in local storage. Until the console loads it on every page, pages other than Sakshi and Gati keep a plain log that Sakshi pages seal when they open.
• The forecast check uses airports up to 100 km from the places they stand in for, and scores temperature, dew point and wind only.

We are looking for an oversight cell or data protection office to pilot SAKSHI against a live audit trail. contact@trinetra.in