The audit log

Every signal InsiderBeacon tracks is written to an append-only log the moment it's published, then again when its entry price and each result come in, and so is every trade and daily value of a published strategy. Each entry carries the hash of the one before it, so nothing can be changed, removed or reordered without breaking every hash after it, and the database itself refuses to change or delete an entry.

Daily checkpoints

At the end of each day (UTC), a checkpoint fixes the hash of the last entry (which pins the whole log up to it) and a Merkle root of the day's entries (so any one entry can be shown to be part of the day with a short proof). The digest is the SHA-256 of the checkpoint's text. No copy of the digests is kept outside this site yet.

How to check it

1. Each entry's hash is the SHA-256 of prev + "\n" + subject + "\n" + kind + "\n" + at + "\n" + data, and its prev is the hash of the entry right before it.
2. Each finished day's entries hash into its checkpoint's root (leaf: SHA-256 of "leaf\n" + hash; node: SHA-256 of "node\n" + left + "\n" + right, an odd one at the end moving up as it is), and the checkpoint's text hashes to its digest.
3. Compare the digest with a copy kept outside this site.
4. Insider buys' prices are sealed: such an entry's data holds sealed, the SHA-256 of salt + "\n" + values. The log checks out without them; where the values may be shown (InsiderBeacon's own pages and app), the salt comes with them so the seal can be opened and checked.

One record, with its proofs (/s/<id>.json):

// Node 18 or later. Save as check-record.mjs and run: node check-record.mjs <signal number>
import crypto from "node:crypto";
const sha = (s) => crypto.createHash("sha256").update(s).digest("hex");
const entryOk = (e) => sha(e.prev + "\n" + e.subject + "\n" + e.kind + "\n" + e.at + "\n" + e.data) === e.hash;
const leaf = (h) => sha("leaf\n" + h), node = (a, b) => sha("node\n" + a + "\n" + b);
const text = (c) => `InsiderBeacon audit checkpoint\nday ${c.day}\nentries ${c.n}${c.n ? ` (#${c.firstId} to #${c.lastId})` : ""}\nlast #${c.lastId} ${c.hash}\nroot ${c.root || "none"}\n`;
// the sides a proof for leaf i of n takes, so a proof can't stand in for another position
const sides = (i, n) => { const s = []; for (; n > 1; i >>= 1, n = (n + 1) >> 1) if ((i ^ 1) < n) s.push(i & 1 ? "L" : "R"); return s.join(""); };
const inDay = (hash, id, p, c) => !!(p && p.path && c) && id - c.firstId === p.index && p.n === c.n && sides(p.index, c.n) === p.path.map((x) => x[0]).join("")
  && p.path.reduce((h, [s, x]) => (s === "L" ? node(x, h) : node(h, x)), leaf(hash)) === c.root && sha(text(c)) === c.digest;
const rec = await (await fetch("https://app.insiderbeacon.com/s/" + process.argv[2] + ".json")).json();
for (const e of rec.entries) {
  const link = e.link ? e.prev === e.link.hash : e.prev === "";
  const day = e.proof ? inDay(e.hash, e.id, e.proof, rec.checkpoints[e.proof.day]) && (!e.link || inDay(e.link.hash, e.link.id, e.link, rec.checkpoints[e.link.day])) : null;
  const seal = e.reveal ? sha(e.reveal.salt + "\n" + e.reveal.values) === JSON.parse(e.data).sealed : null;
  console.log(`#${e.id} ${e.kind}: hash ${entryOk(e) ? "ok" : "WRONG"}, link ${link ? "ok" : "WRONG"}, checkpoint ${day == null ? "not made yet" : day ? "ok" : "WRONG"}${seal == null ? "" : ", sealed values " + (seal ? "ok" : "WRONG")}`);
}
for (const c of Object.values(rec.checkpoints)) console.log(`${c.day}: digest ${sha(text(c))}. Compare it with a copy kept outside this site.`);

The whole log, oldest first, from /api/audit/chain (entries more than 24 hours old, 1,000 at a time), against every checkpoint:

// Node 18 or later. Save as check-log.mjs and run: node check-log.mjs
import crypto from "node:crypto";
const sha = (s) => crypto.createHash("sha256").update(s).digest("hex");
const entryOk = (e) => sha(e.prev + "\n" + e.subject + "\n" + e.kind + "\n" + e.at + "\n" + e.data) === e.hash;
const leaf = (h) => sha("leaf\n" + h), node = (a, b) => sha("node\n" + a + "\n" + b);
const text = (c) => `InsiderBeacon audit checkpoint\nday ${c.day}\nentries ${c.n}${c.n ? ` (#${c.firstId} to #${c.lastId})` : ""}\nlast #${c.lastId} ${c.hash}\nroot ${c.root || "none"}\n`;
const root = (hs) => { let l = hs.map(leaf); while (l.length > 1) { const n = []; for (let i = 0; i < l.length; i += 2) n.push(i + 1 < l.length ? node(l[i], l[i + 1]) : l[i]); l = n; } return l[0] || ""; };
const days = new Map(); let prev = "", after = 0, before = 0, n = 0;
for (;;) {
  const page = await (await fetch("https://app.insiderbeacon.com/api/audit/chain?after=" + after)).json();
  before = page.before;
  for (const e of page.entries) {
    if (e.prev !== prev || !entryOk(e)) { console.log("BROKEN at entry #" + e.id); process.exit(1); }
    const d = new Date(e.at).toISOString().slice(0, 10);
    days.set(d, (days.get(d) || []).concat([e]));
    prev = e.hash; n++;
  }
  if (!page.next) break;
  after = page.next;
}
const { checkpoints } = await (await fetch("https://app.insiderbeacon.com/api/audit/checkpoints")).json();
for (const c of checkpoints) {
  const list = days.get(c.day);
  if (!list || Date.parse(c.day + "T00:00:00Z") + 864e5 > before) continue; // not all public yet
  const ok = list.length === c.n && list.at(-1).id === c.lastId && list.at(-1).hash === c.hash && root(list.map((e) => e.hash)) === c.root && sha(text(c)) === c.digest;
  console.log(`${c.day}: ${ok ? "matches the log" : "DOESN'T MATCH"} (digest ${c.digest})`);
}
console.log(n + " entries, every hash and link ok. Compare the digests with copies kept outside this site.");

What the log proves: nothing logged has changed since its day's checkpoint was copied outside this site. What it can't prove: anything before it was logged, or what happened before a copy existed. Signals the app tracked before this log started (Oct 17, 2026) were logged that day and are marked "logged after the fact", like the insider buys added when the track record began. Moves by wallets that aren't top traders are private and never logged.