Records and reporting

The audit trail, the evidence pack and exporting your data

2 min read · Checked against the product 3 October 2026

What the hash-chained audit trail records, how to produce the audit PDF and the evidence pack ZIP for a portal or an adjudication, and how to take a full copy of your data.

Evidence is only as good as the trust in it. Every variation in VariationFlow carries an audit trail that cannot be quietly edited, and every record can leave the system in a form the other side can check.

What the audit trail records

Each status change, value change, upload and note is written to the variation’s audit trail with who did it and when, including the main contractor’s answers from the review link, the build-up, payments and moves between projects. The trail is append-only, and each entry is linked to the one before it with a SHA-256 hash, so a later insertion, deletion or edit would show up when the chain is checked.

The evidence package

Photos, voice notes, signatures, documents and forwarded emails sit in the variation’s Evidence package. Each uploaded file’s SHA-256 fingerprint is recorded, and a capture time from a phone whose clock runs ahead is refused, because future-dated evidence is the first thing an adjudicator questions.

Producing the record

• Export PDF, on the variation’s audit trail, opens a self-contained audit document to print or save: the variation, its evidence and its full history, with a line at the top saying whether the hash chain verified at the moment of export.
• Evidence pack (ZIP), beside it, is for a main contractor’s portal: the audit record, CSVs of the variation, its build-up and its evidence, and the original evidence files with each file’s SHA-256, so the copy can be checked against the master. It is available to the commercial roles.
• Export CSV, on the register, downloads the register you are looking at.

Taking all of your data

In Settings, Organisation, “Export your data” gives admins and directors two copies of the whole organisation. The readable report lays out projects, the register and valuations to view or print. The JSON copy is complete and machine-readable: every project, customer, variation and valuation, an evidence manifest with download links that last 72 hours, and the audit trail with its hash-chain fields for independent checking. Save the evidence files themselves within the 72 hours. Anyone can download the personal data held about them from Settings, Notifications.

When to use which

• A disputed variation: the audit PDF, attached to your response or referral.
• A main contractor that wants everything in its own portal: the evidence pack.
• A month end, an audit, or moving systems: the full account export.

Common mistakes

• Keeping the real evidence in a messaging group and uploading a summary later. Capture the original in VariationFlow so it is fingerprinted on the day.
• Downloading the account export and not saving the evidence files before the links expire.
• Sending screenshots of the register instead of the audit PDF, which is the document that proves its own history.