Answers · bookkeeping
How do I prove my small business books weren't edited after the fact?
Last updated
TL;DR: Lock each period once it's reconciled, keep the accounting software's audit log, and at every close save the key reports as files, hash them and get the hashes timestamped by someone outside the business. Lock dates and audit logs live inside an account that an admin controls (admins can remove lock dates, and QuickBooks Online keeps audit-log events for two years), so the outside timestamp is what lets a lender, buyer, auditor or partner check later that the numbers you showed then are the numbers you have now. Fix mistakes in closed periods with new adjusting entries, not edits.
What should I check, step by step?
1. Reconcile the month, then lock it. In QuickBooks Online turn on Close the books and pick the option that requires a password, not the warning-only one. In Xero set a lock date (only the administrator role can).
- Keep the closing-date password or the Xero administrator role away from whoever does day-to-day entry. The owner or the outside accountant should hold it.
- At each close, export the trial balance, general ledger detail, balance sheet and profit and loss as PDF or CSV files and store them outside the accounting software.
- Compute a SHA-256 hash of each file (sha256sum on Linux, shasum -a 256 on macOS, certutil -hashfile <file> SHA256 on Windows) and keep the list of hashes with the files.
- Get the hash list timestamped outside the business: an RFC 3161 time-stamping authority, an OpenTimestamps proof anchored in Bitcoin, or a third-party record service. Emailing it to your accountant gives a dated copy too, but a weaker one.
- Correct closed periods with a dated adjusting entry in the open period and a note saying why. If you must reopen a period, export and hash a new version and keep the old one.
- Keep the files and hashes as long as your tax records. The IRS says 3 years in general, 4 years for employment tax records, 6 years if more than 25% of income went unreported and 7 years for bad-debt or worthless-securities claims. That's longer than QuickBooks Online's two-year audit log.
What lock dates and audit logs do, and what they don't
QuickBooks Online's Close the books setting protects transactions dated on or before the closing date. Depending on the option chosen, anyone changing them gets a warning or must enter a password. With the warning-only option, users can still save changes.
- The QuickBooks Online audit log can't be turned off. It records sign-ins, settings changes, edits to customers, vendors and employees, payroll submissions and deleted transactions, and Intuit says events are available for two years. Each transaction also has an Audit history with a Compare Versions view.
- In Xero, only the administrator role can set lock dates. A lock can apply to all users or to everyone except administrators, and administrators can remove it temporarily to make changes. Changes to financial settings show in History & Notes.
- These are good controls against accidents and staff, but they sit inside an account an admin controls and a vendor hosts. They're records you can show someone, not records an outsider can check on their own.
How a hash and an outside timestamp prove the books didn't change
A SHA-256 hash is a 64-character fingerprint of a file. Change one digit in an exported report and the hash comes out completely different.
- A timestamp from someone outside the business, such as an RFC 3161 time-stamp token or an OpenTimestamps proof anchored in Bitcoin, shows the hash existed at that time. Later, anyone can hash your saved file and compare.
- This proves the saved file is unchanged. It doesn't prove the numbers were right when you saved them, or that the software still shows the same thing today. Re-export the same reports and compare them with the hashed copies to check that.
Sealing records as they happen, not just at month end
Month-end hashes cover totals. Disputes are usually about one invoice, refund or tip. Sealing each record when it happens means a later change to a single invoice shows up, not just a change in a monthly total.
- Keep personal data out of anything you seal with a third party. Use your own invoice numbers and customer references instead of names or emails.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Is the Rightshold ledger block that seals my mirror-ledger entry anchored in Bitcoin yet?”
{
"tool": "ledger_anchor",
"arguments": {
"height": "<anchor.block_height from GET /v1/mirror-entries/{id}>"
}
}- Free, no key (MCP toolset=ledger). It returns the anchor status per OpenTimestamps calendar and the .ots proof to check with ots verify.
- Rightshold's mirror ledger is a REST API and needs an API key. POST /v1/mirror-ledgers opens one, known publicly only by a neutral label such as 'Service business #1'. POST /v1/mirror-ledgers/{id}/entries seals an invoice, adjustment, payment, tip_allocation, tip_payout or dispute_note entry. Amounts are integer cents. occurred_at is the date you give; sealed_at is Rightshold's clock.
- Entries are hash-chained, and their hashes (not their content) are written to Rightshold's append-only public ledger, whose blocks are timestamped in Bitcoin through OpenTimestamps. There is no edit or delete route: a correction is a new adjustment entry.
- Anyone with an entry id can check it free, without an account: GET /v1/mirror-entries/{id} returns the record as sealed, its hash-chain check and its anchor status. POST /v1/mirror-entries/{id}/dispute opens a review case with the sealed entry as the evidence.
- Content with names, emails, phone numbers, addresses or tax ids is refused. Refer to people by your own references (customer_ref, worker_ref).
Rightshold doesn't connect to QuickBooks or Xero, check your numbers or do bookkeeping. The mirror proves what you sealed and when. It doesn't stop you from changing your own books, and it can't show a record was accurate when you sealed it. Sandbox accounts stay off the public ledger. Not legal, tax or accounting advice.
What are the sources?
- QuickBooks Online: Use the audit log (can't be turned off, events available for two years)
- QuickBooks Online: Lock your books (closing date, warning or password)
- QuickBooks: View transaction changes in the audit history
- Xero Central: Set up or remove lock dates
- Xero Central: User role access to settings (set lock dates: administrator only)
- IRS: How long should I keep records?
- RFC 3161: Time-Stamp Protocol
- OpenTimestamps client
Related
- How to make LLM eval results reproducible and tamper-evident
- How to prove what an AI model said at a specific time
- How to audit which human authorized an AI agent action
- How to log every AI agent tool call for audit
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'