Guarantees
Cryptographic and Storage Guarantees
Audience: Security Architects / Auditors / Technical Leaders
Horizon provides specific, verifiable guarantees at the architectural level.
Storage Guarantees
| Property | Guarantee |
|---|---|
| Append-only | Facts cannot be modified or deleted (no mechanism exists) |
| Hash chain | Each fact links to previous via prev_hash |
| Tamper detection | Any modification breaks chain and is detectable |
| Tenant isolation | Facts scoped by tenant_id at data layer |
| Authoritative timestamps | sealed_at_ms assigned by Horizon, not client |
Cryptographic Guarantees
| Property | Guarantee |
|---|---|
| Hash algorithm | SHA-256 applied to canonical JSON |
| Signature algorithm | Ed25519 for bundle signatures |
| Deterministic hashing | Reproducible across implementations |
| Verification independence | Requires only bundle + public key |
What Is NOT Guaranteed
- !Truth of declarations (your responsibility)
- !Actor identity verification (your authentication)
- !Business logic validation (your process)
- !Availability (standard SLA applies)
- !Key security (your operational security)