Our commitments and limits.
AuditTrace Labs is built around evidence that can be examined, boundaries that are explicit, and conclusions that remain subject to human review. These are the commitments we make and the limits we state plainly, so our work can be evaluated against what the evidence actually supports.
Last updated: 2026-09-02
Commitments we are willing to be held to.
We tell you what the evidence supports
Including when the honest answer is that the evidence does not establish what you hoped, that a system was probably fine, or that the question you asked is not the question the evidence can answer. Where a stronger statement is unsupported, we give you the weaker true one.
You approve anything consequential
We recommend, prepare, compare and document. We do not approve our own work, and nothing we build approves itself. Consequential conclusions and decisions remain with a person who has the authority to make them.
Scope and authorization are agreed before we start
Written first, and changed only by asking. Scope does not expand quietly. Forensic and technical work only involves systems, accounts, devices, records or evidence for which appropriate authorization exists.
We record a state before we change one
Where an engagement involves altering a system, we preserve the relevant prior state first where the engagement and available evidence permit it, so a result can be stated as a measured difference rather than asserted.
We separate what is known from what is not
Observed fact, derived conclusion, uncertainty and missing evidence are labeled as what they are. A reviewable record is one where you can see which is which — including the gaps.
We distinguish what exists from what is planned
Capabilities available today are described separately from research, design work and program development. Intent is not delivery, and we do not describe a design as though it were a shipped capability.
You own the work product
The findings, documentation, comparisons and preserved records produced for your matter belong to you, whether or not the engagement continues.
Forensic work has real limits, and pretending otherwise is its own failure.
None of the following can honestly be guaranteed by anyone. We would rather say so here than imply otherwise and disappoint you later.
We do not guarantee:
- that deleted, overwritten, or missing evidence can be recovered
- that sufficient evidence still exists to answer your question
- that every incident can be reconstructed
- that every system state can be recreated
- that every matter can be accepted
- that the evidence will establish what you expect it to establish
- that an opposing party will accept a conclusion
- that evidence will be admissible in a legal or other formal proceeding
- that a court, regulator, insurer, attorney, or law-enforcement agency will reach any particular conclusion
- that meaningful review remains possible more than 90 days after an event
- that forensic review will produce a particular result
- that a workflow, record, or preserved artifact will satisfy a compliance obligation — that determination belongs to the body making it, not to us
We also do not hold certifications we have not earned. We design and document evidence-handling and custody workflows, and we preserve third-party documentation where it exists, but we do not describe our own work as certified and we do not present AuditTrace Labs as a law firm, a law-enforcement agency, a court, a prosecutor or an emergency service.
A design goal, stated as a design goal.
A design goal of AuditTrace Labs is to preserve sufficient relevant context to support meaningful review beyond the immediate incident window, including more than 90 days after an event, where the available source evidence and the chosen retention scope support it.
That is a goal we design toward. It is not a retention guarantee, it does not apply to evidence that was never captured, and it cannot recreate what no longer exists. Where the source material or the agreed retention scope will not support later reconstruction, we say so at the time rather than after the fact.
What a hash does, and what it does not.
A cryptographic hash can help demonstrate that a particular set of bytes has not changed between two points at which it was measured. That is genuinely useful, and it is also the full extent of what the hash itself establishes.
It does not establish where an artifact came from, who produced it, when the events it describes occurred, whether it is complete, or what it means. Those depend on other things entirely:
- acquisition context and the conditions under which evidence was collected
- provenance and, where applicable, custody records
- chronology and timestamps, and their known reliability
- the surrounding system state at the relevant time
- manifests, comparison records and supporting artifacts
- documented limitations, including what was not collected
We will not tell you that a checksum proves your case, and we will be direct if integrity verification is being asked to carry more weight than it can bear.
Software prepares the record. A person reaches the conclusion.
Software and AI may organize evidence, compare states, identify relationships between artifacts, surface discrepancies, and help assemble reviewable packages. That is useful work and we use it deliberately.
Where an automated system or assistant is involved in our own work or in something we build for you, its permitted and forbidden actions are defined explicitly, it is tested against realistic work including the cases where it should refuse or escalate, and a person remains in charge of the decisions that matter. We do not connect a general-purpose assistant to a live environment and leave it to operate broadly.
Lineage without surveillance
Preservation is not the same thing as monitoring people. Our records concern systems, evidence and the work performed on them — not the behavior of individuals. We do not build continuous employee monitoring, behavioral profiling, or scoring of people, and we do not treat indiscriminate collection as a substitute for scoped, authorized preservation.
An inquiry path, described accurately.
AuditTrace Labs maintains an inquiry path for people whose matters fall below the engagement thresholds normally associated with a large forensic firm. We think the dollar amount should not be the only reason evidence goes unexamined.
Being honest about that means being equally clear about its boundaries. Submitting an inquiry does not guarantee that a matter will be accepted. Reduced-scope, reduced-fee or no-cost assistance is not guaranteed and is not an established program. Laboratory capacity, technical fit, authorization and the evidence that actually remains available all bear on whether we can help, and sometimes the honest answer is a referral elsewhere or an explanation of why review is unlikely to resolve the question.
We would rather set that expectation plainly at the start than encourage someone to hope for an outcome we cannot commit to.
Tell us, and we will correct it.
If any wording on this website claims more than AuditTrace Labs can actually do, we treat that as a defect in the wording rather than a target to grow into. If you find a claim on this site that overstates our capability, email contact@audittracelabs.com and we will review it and correct the page.
This page is reviewed as the company's capabilities change. Where a limit stops being true, it will be removed rather than quietly reworded.