Who Watches the Watchers?
A security product holds a complete record of what everyone in the firm did. That is exactly as dangerous as it is useful — so deep access takes two people, every use is recorded, and the record itself is built to show if anyone edited it.
In short
- Escalated access needs two people. One requests, a separate authorised approver grants. There is no self-elevation path in the product.
- Sessions are bounded and recorded — every action inside one is written to an audit trail the investigator cannot edit.
- The audit log is tamper-evident. Entries are chained, so removing or altering one is detectable.
- Legal hold exempts evidence from deletion, including from the routine retention that would otherwise remove it.
- Where dual consent is impossible, the feature is unavailable rather than quietly relaxed.
The tool that watches everyone
To do its job, this product holds a detailed record of what every person in the firm did: which files they opened, when they signed in, what they ran. During an investigation that record is exactly what you need.
At every other time it is a concentration of extremely sensitive information, sitting in one place, accessible to whoever administers it. In a law firm that includes matter activity; in any firm it includes the partners.
Not “is it secure” — “what stops the person who runs it from reading everything about me?” A product in this category needs a better answer than a promise about staff conduct.
Two people, and no way around it
Ordinary use of the product does not require this. Investigation mode is the escalated tier — deeper access for a defined purpose, and it is gated.
- RequestAn analyst or administrator opens a session request, stating the purpose.
- ApproveA different person holding the approver permission grants it. That permission is separate from being an administrator and is not held by default — including by the first administrator account.
- Work, recordedThe session is time-bounded, belongs to the requester alone, and every action inside it is written to the audit trail.
- CloseThe session ends and is summarised. The record remains.
The path is not disabled; it does not exist. A development bypass that once existed was deleted in June 2026, and its absence is now the documented model. Nobody can grant themselves investigation access, including the person who installed the product.
At a firm with a single administrator, dual consent is structurally impossible — so investigation mode is unavailable there, and the request is refused with an explanation rather than left pending forever.
Allowing audited self-authorisation for a lone administrator is a reasonable alternative and is an open decision, deliberately not made quietly in code. Until it is made, the conservative behaviour stands.
An audit log that shows if it was edited
An audit trail an administrator can quietly edit is not an audit trail. Chronolith chains its audit entries together cryptographically: each one is bound to the one before it.
Removing an entry, or altering one, breaks the chain from that point onward — and the break is detectable without needing a copy of the original.
A tamper-evidence mechanism that reports tampering on a healthy system is worse than none, because the second time it fires nobody investigates.
Exactly one process in the whole system is allowed to extend the chain, precisely so that concurrent writes cannot produce a chain that fails its own verification. That was found the hard way in an earlier mechanism, and it is why this one is built the way it is.
Evidence outranks storage
Ordinary events are deleted on a retention schedule. Evidence is not.
- Records attached to a case are exempt from routine deletion.
- Records under legal hold are exempt, and the hold is recorded with who placed it and when.
- A search itself can be held, not just its results — so the question that was asked is preserved alongside the answer, which is what makes an exhibit reproducible later.
- Nothing is deleted that the archive does not already hold. If a day could not be archived, that day is not pruned — the appliance keeps the data and says so, rather than freeing disk it cannot account for.
Archived days are sealed with a checksum. Telemetry sometimes arrives after the day it describes — a laptop delivering a week away, a forwarder catching up — and those late events have to go somewhere without disturbing a seal that has already been taken.
They are written to a separate, additional object for that day, with its own checksum. The original is never rewritten, because an archive whose checksum changes cannot be verified against anything. Restoring a day replays every part, so nothing that arrived late is quietly left out of the evidence.
Days sealed before that mechanism existed are a different case: nothing records which of their events the seal already covers, so they cannot be completed the same way — and an appliance that refuses to prune them would refuse forever, keeping every day past its retention window on disk with the safety rule as the reason. Those days are instead completed by writing the whole day into a new object beside the untouched original. The first seal still stands, the two together provably cover the day, and pruning resumes on its own. Nothing already sealed is ever rewritten to make this work, and a day that still cannot be completed still stops the prune.
The appliance is designed so that the application — the part exposed to the network — does not hold the privileges needed to erase its own tamper-evident record. An attacker who compromises the web application should not thereby gain the ability to delete the evidence of having done so.
Common questions
Can your staff see our data?
The appliance is yours, on your premises, single tenant. There is no vendor access path into it and no telemetry of your event data leaves it. Support works from information you choose to send Aperlock, and Chronolith generates a support bundle so you can see what it contains before it goes anywhere.
Who can approve an investigation session?
Only someone holding the approver permission, which is separate from being an administrator and is granted deliberately. Firms typically place it with a managing partner or a compliance officer rather than with IT — which is the point, since it separates the person who can request deep access from the person who can authorise it.
Does the AI have access during an investigation?
AI assistance summarises what the investigator is already looking at, within their session. It cannot access anything the investigator cannot, cannot initiate a session, and cannot take action — the same authority boundary that applies everywhere else in the product.
Would this stand up in a dispute?
The mechanisms are designed for that purpose: attributed actions, a tamper-evident record, holds that survive routine deletion, and preserved search parameters so an exhibit can be reproduced. Whether any particular record is admissible is a question for your counsel, and we would rather say that than imply a guarantee no vendor can give.