SHA-256 EVIDENCE

Know which digital letter is the original.

An important letter can pass through several drafts before it becomes the version a customer actually issues. Epistles is designing document integrity controls that distinguish that issued file from later changes. The SHA-256 fingerprint of an exact PDF can help an authorised user check whether a file still matches the final version retained in the record.

Client workspace available · Postal services quoted separately
EPISTLES / SHA-256 EVIDENCE
E.
Documented. Organised. Understood.✳
PRACTICAL GUIDANCE

The correspondence workflow in practice.

Consider two documents that look nearly identical: the subject and recipient are the same, but one amount or paragraph has changed. File names are unreliable evidence of which document was sent. A stored fingerprint and finalisation record can help answer that question without requiring the user to inspect every page by hand.

Integrity must be presented responsibly. A hash cannot tell a recipient whether an identity was checked, whether a post carrier accepted an envelope or whether the person read it. Those facts need their own evidence and authentication controls.

A practical integrity check begins with the exact file that matters. A customer may have saved several copies of a formal letter in different folders, and a colleague may have converted one into a different PDF format. Two files that look the same on screen can have different bytes and therefore different hashes. The product should explain this behaviour rather than implying that a mismatch always means malicious alteration. The original finalised file and its recorded fingerprint are the correct point of comparison.

For higher-assurance evidence, a signed manifest can associate the relevant file digests with the letter reference and finalisation event. Independent timestamp evidence may add value where the use case warrants it. These controls require careful key management, verified event sources and defined retention; placing a hash on a decorative certificate is not enough. The user-facing report should translate the result into plain language while preserving the technical details for an authorised reviewer.

01 / 02

An example: two files with the same visible title

Two PDFs can share a file name while containing different information. A colleague may correct a date, export the document again or change an enclosure. Keep the version that was finalised for a particular use identifiable, and associate its reference with the relevant file comparison. A later working copy should not silently replace that issued record.

When discussing integrity requirements, explain which exact files need to be checked: the main letter, each enclosure, or a combined output. Also identify who is authorised to finalise or replace them. A fingerprint comparison is useful only when the reference record is itself handled appropriately. It concerns file identity and change detection, rather than independently establishing the correctness of the wording, the sender's authority or the outcome of a physical delivery.

02 / 02

SHA-256 integrity, without exaggerated claims

A SHA-256 digest is a cryptographic fingerprint calculated from the exact bytes of a document. If the file changes, the digest will almost certainly change too. Epistles can retain that digest for each finalised PDF and enclosure and use it when an authorised person wants to check file integrity later. The process is useful for distinguishing an issued version from an altered copy.

A hash is not automatically a digital signature or a legal declaration of authenticity. Establishing who approved a document, when it was issued and how a delivery happened requires additional records and appropriate controls. That is why the proposed evidence system brings together file fingerprints, signed event records, trustworthy timestamps and recorded delivery information rather than showing a hash value alone.

GOOD TO KNOW

Questions worth asking.

Clear answers about the workflow and its limits. The service described is being developed; availability is confirmed only when a feature is launched and tested.

What is SHA-256?

It is a cryptographic hash algorithm used to calculate a fingerprint from the exact bytes of a file.

Does a matching hash prove who wrote the letter?

No. It supports file integrity but does not alone authenticate the author or identity.

What happens when an attachment changes?

Each finalised file should have its own fingerprint; a new version requires a new recorded digest.

Can evidence be independently checked?

The planned design considers signed manifests and suitable timestamps for stronger, independently verifiable evidence.

Is this the same as a digital signature?

No. Digital signatures combine cryptographic techniques with signing keys and identity-related assurances.

Public resources are available now.

The client workspace, document records and QR verification are available at my.epistles.uk. Postal requests start with a quotation. Contact Epistles to discuss your requirements.

CONTACT EPISTLES

Bring us the correspondence task you want to improve.

Tell us what you need, who is involved and the outcome you want to achieve. We will discuss the right next step.