Evidence Integrity & Chain of Custody

Every file that reaches Estimatics is stamped, hashed, and logged by the server at the moment it arrives. This page describes exactly what that means — and is deliberately precise about the limits, because in appraisal and litigation an overstated claim is worse than no claim.

This applies to every account, on every plan. It isn't a paid tier or a module to switch on.

The problem it solves

A record made entirely of the uploader's own claims can't corroborate anything about the uploader. If the device reports the time, the location, and the file's own hash, then a device that lies about one is trusted about all three.

So Estimatics splits the record in two: what the device reports, and what the server can observe independently. Both are kept. Only the second one is used to verify the first.

What the server records on arrival

Recorded	What it means
Server-side SHA-256	The hash the server computes by re-reading the bytes it actually received — not the value the uploader sent
Client-declared SHA-256	What the device said the file's hash was. Preserved, never trusted on its own
Verification status	The comparison between the two — see below
Clock offset	The gap between the device's clock and the server's at the moment of upload
Location permission	Whether GPS was `granted`, `denied`, or `unavailable` when the file was captured
Capture origin	Whether it came from a team member or a FIELD Lite invitation
Device provenance	Device identifier, model, OS and version, device time zone, and the app version that produced the file

Hash verification runs as a background job rather than inline. A video is hundreds of megabytes, and making an upload wait on a full re-read would be the first guarantee dropped under pressure — so it's queued, and always runs.

The five verification states

Status	Meaning
Pending	Received; the server hasn't finished re-reading it yet
Match	The server's hash equals the one the device declared. The strongest state
Mismatch	They differ. The file that arrived is not the file the device said it sent
Unverifiable	The server hashed the file, but the device declared nothing to compare against
Unreadable	The server could not re-read the stored bytes to hash them

Unverifiable is not the same as Match, and the distinction is the point. The server's hash is the one that counts — it's the only one that doesn't depend on the word of whoever uploaded. But without a client declaration, the other half is missing: you can no longer detect a corrupted upload or a client misreporting what it sent. Which of the two is enough is a judgment for whoever is reading the file.

The event log

Evidence events are recorded append-only — entries are added, never edited or removed. The log is what lets you show the sequence: when a file arrived, what was stamped on it, and what verification concluded.

ℹ Note

There is no evidence-log screen in the web app today. The record is captured and retained on every account, and it is available on request — email support@aiestimatics.com with the job. A user-facing view is not currently available.

What this does not prove

Being precise here is the whole value of the feature.

It does not prove the damage is real, or that it was caused by the loss. Integrity is about the file, not the interpretation.
It does not prove someone was physically present. It records whether the device reported a location and whether permission was granted — a device can be wrong, and permission can be denied.
It does not prove the moment of capture. It records the device's timestamp and how far the device's clock sat from the server's. That is evidence about the timestamp, not a guarantee of it.
It does not make a photograph admissible. Admissibility is decided by a court under its own rules.
It is not a digital signature or a notarization. No third party attests to anything.
It does not assign liability or determine coverage.

What it does support is a narrower and more defensible claim: the file in the record is byte-for-byte the file the server received, and here is everything the server could independently observe about how it got there.

Getting the most out of it

Leave location permission on. Denied is recorded honestly, and honestly recorded absence is still a gap in the file.
Capture in the app, not the camera roll. A photo imported from elsewhere has no device provenance to stamp.
Keep the app updated. The app version is part of the provenance chain.
Watch for Mismatch. It's rare, and it means the upload didn't deliver what the device had — recapture rather than explain it later.

Evidence coverage

Whether the file is complete, area by area — a different question from whether it is intact.

Report types

What Estimatics composes from the evidence on a job.

FIELD Lite captures

How a capture from outside your team is marked in the record.

What Estimatics stores and for how long.

Last updated: September 2026 · Questions? Email support@aiestimatics.com