Compliance

The compliance record: what your workspace handed over, who approved it and what became of it, sealed the moment it happened so it can be shown years later, to somebody who was not there, exactly as it was.

Compliance sits under Overview, below Posts and Schedule, and is part of Enterprise. It is shown to the owner, to whoever holds the Approvals or the Administration permission, and to your auditors. Somebody who only operates does not see it. On every plan below Enterprise it is not in the menu, except for the 90 days after a workspace leaves Enterprise (see Leaving Enterprise).

The screen holds five cards, one under the other: Compliance record, Entries, Approval rules, Audit log and Auditors.

Why there is a record

A bank, a broker, a public body is audited, sometimes years after a post went out, and has to show three things: what was published, who approved it, and that nobody changed either since. Posts alone cannot answer that. A clip is removed from storage within weeks to make room for newer ones, a post can be updated or taken down, a channel can be removed, and a colleague who approved something may have left. So the record keeps its own copy of the facts, one entry per thing that happened, written once and never changed.

It records from the moment the workspace is on Enterprise: what was handed over before that is not in it. Nothing has to be switched on; the first post the workspace hands over is the first entry.

What is recorded

What	When it is written
Handed over	A post goes out on a channel: by email, to your webhook, through the platform connector, or to syndication participants alone.
Update handed over	A change to a post that went out was handed over.
Delete handed over	A request to take a post down was handed over.
Sent again	A post was sent again: its email, its webhook call, a repost through the platform connector, a resend to syndication participants, or a post that failed tried again.
Approval decision	Somebody approved or rejected a post or a change to one, or gave the first of two approvals.
Delivery outcome	An email was sent, a webhook answered, a platform posted it, or every attempt failed.
Reported	Somebody, or the platform connector, said where a post stands: published with its link, skipped, not posted, or deleted.
Approval rule changed	A channel's approval was switched on or off, or its number of approvers changed.

A hand-over is one entry per channel, because an audit asks about one post on one account: "this video, on this channel, on this day". A post that went to four channels is four entries.

Each Handed over entry carries the whole of what went out on that channel:

• the channel, its platform, shape and language, and the brand it wore;
• the text exactly as it went out, in every length it was handed over in, with the hashtags and the brand's line;
• the video's fingerprint, its SHA-256, which identifies that one file and no other;
• three frames of the video, taken at a tenth, the middle and nine tenths of it, so a person can see what it showed without the file;
• the template, its variant and version, and the fingerprint of the build that drew it;
• where the content came from (a ready-made feed, a post list or a custom feed) and who wrote it: the person, or the API key that sent it;
• for a ready-made feed, what Reelwire's AI steps did to it before it was sent;
• whether the channel asked for approval, and who approved, when, and with which note;
• the ways it went out.

People are named as they were at that moment, by name and sign-in address, and API keys by their label. A colleague removed later, or a key revoked or renamed, does not empty the record of who did what.

How it is sealed

Three locks, each one closing a door the one before leaves open.

1. The chain. Each workspace's entries are numbered 1, 2, 3 and on, and each entry's hash covers its number, its content and the hash of the entry before it. Change or remove one entry and every entry after it no longer links up.
2. Reelwire's signature. Each entry's hash is signed with Reelwire's own key, so an entry shows it was written by Reelwire at the time, not composed afterwards by whoever holds a copy.
3. The daily time stamp. Once a day, the newest entry of every workspace is time-stamped by an outside time-stamping authority, which signs "this existed at this moment". From then on nobody, Reelwire included, can change an entry from before that moment without it showing. The authority is named on the card and on every time stamp.

An entry appears in the list the moment it is written and reads Being sealed for the few seconds until it has its number and signature. It is covered by the next day's time stamp.

Compliance record

The first card says what is set, one fact a line:

• Recording: On, or Off where the workspace left Enterprise.
• Entries: how many there are, how many are being sealed this moment, and since when.
• Daily time stamp: up to which entry the newest time stamp reaches, by which authority and when. While the authority is out of reach it says so; it is asked again every few minutes.
• Kept: ten years from each entry.

Under it are its two actions: Download export for an auditor and Check a video.

Download export for an auditor

What you hand to an auditor, in one zip. The dialogue asks two things:

• Period: whole days, from and to, in your own calendar. It opens on the last 30 days.
• Channels: Every channel, or switch it off and tick the channels the audit is about.

Download export saves it to your Downloads folder, named after the workspace and the period. In it:

File	What it is
report.pdf	The record laid out for a person, post by post: what went out on which channel and when, three frames of the video, its text, where it came from and who wrote it, what AI did to it, who approved it, its fingerprint, and everything that happened to it afterwards. Its first page says what Reelwire found when it checked the export before writing it.
records.json	The record itself: every entry with its content and its seal, the chain's links, each daily time stamp with the proof that it covers this workspace's entries, and the public keys the entries were signed with.
anchors/	Each daily time stamp, as the authority answered it.
stills/	The frames the report shows.
verify.mjs	Every check, written out, to run on any computer with Node.js.
README.txt	What all of it is, and how to check it.

The report describes; the records prove. A PDF can be edited like any document, so what an auditor relies on is records.json, checked with verify.mjs. Text in a script the report's typeface does not carry is exact in records.json, and the report says so.

One export holds at most 3,000 entries. A period holding more is refused with a sentence saying so: choose a shorter period, or fewer channels, and export the rest separately. An entry still being sealed is in the next export, seconds later.

How an auditor checks it

Nothing in the check asks Reelwire. Unpacked into a folder, on a computer with Node.js 18 or newer:

1. node verify.mjs checks that every entry reads as it did when it was written, that Reelwire's signature on it holds, that the chain links up without a gap, and that each daily time stamp covers the entries it says it covers. It prints one line per finding and ends with "Everything checked holds." or how many checks failed.
2. node verify.mjs --clips <folder> also says which entry each video in that folder is, by its fingerprint.
3. The time stamps' own signatures are checked with OpenSSL. A daily time stamp's root, in records.json, is the hash the authority signed, so it is given as the digest: openssl ts -verify -digest <root> -in anchors/<day>.tsr -CAfile <CA bundle>, where the bundle holds the authority's root certificate (most computers' own bundle does). README.txt says the same, with the authority's name.

What a passing check means: an entry that passes was written by Reelwire and has not changed since. An entry a time stamp covers existed, as it is, at the moment the authority signed. Entries newer than the last time stamp are sealed and signed, and wait for the next one.

Check a video

Which post is this file? Choose a video, or drop it on the dialogue. Its fingerprint is worked out on your own computer; the file itself is not uploaded. Every entry that names that fingerprint is listed with its date, channel and entry number.

A match proves the file is the one handed over, to the byte. A copy downloaded from a platform never matches, because every platform re-encodes what it publishes: the fingerprint is of the file Reelwire handed over to you. Keep those files, from the email's post kit, your webhook or View and download on Posts, while they are there to keep.

Entries

Everything the record holds, newest first, one line each: when, what (as a coloured label: green for a post handed over, an approval, a delivery or a publication; peach for a rejection, a failed delivery or a post not posted; amber for the first of two approvals; grey for the rest), the channel, what the entry says in a line, and its number in the chain, with how many frames it keeps.

The period at the top opens on the last 30 days. Search reaches the text of a post, a channel's name, a post id or an entry's hash. What filters by the kind of entry and Channel by channel; the list can run oldest or newest first.

Details on a line opens the entry whole: what it says, its three frames, the facts an auditor asks first (the channel, the text, the template, who wrote it, who asked for a change, what AI did, who approved it and the video's fingerprint), then As recorded, the entry exactly as Reelwire wrote it, then its Seal (its number, its hash, the hash of the entry before it and Reelwire's signature) and the Daily time stamp that covers it. Nothing in it can be changed.

Where a clip was removed from storage before its frames could be taken, Details says no frames were taken; its fingerprint still identifies it.

Approval rules

Every channel that holds its posts for a person (switched on in the channel's Settings under Channels), and how many people must approve.

Two rules apply on Enterprise:

• Never the author. Whoever wrote a post, or asked for a change to one, can never approve it: the person who wrote it in a post list, or the API key that sent it. Somebody else has to. This is always on, on every channel that asks for approval, so it is stated on the card rather than offered as a switch. Rejecting is not held to it: anybody holding Approvals may stop a post, its author included. A post from a ready-made feed has no author in your workspace, so anybody holding Approvals clears it.
• One or two approvers. Per channel, one approver is enough, or two approvers: two different people holding Approvals each approve it, neither of them its author. The first approval keeps the post waiting, and Posts names who gave it; the second sends it on. A rejection at either step ends it.

Settings on a row changes the number. It is shown only to somebody holding Approvals, because lowering it loosens a control as much as switching approval off does; everybody else reads the card. A new number applies to posts and changes that start waiting from then on: anything already waiting keeps the number it was asked with. Every change, like every switch of a channel's approval, is an entry of the record with who made it.

A workspace where one person holds Approvals cannot clear what that person writes: add a colleague with Approvals on Team.

Audit log

Everything people and API keys did in the workspace, newest first: settings changed, colleagues added and given permissions, keys made, posts approved, changed and reported, exports downloaded. Each line says when, who (a person by address, a key by its id), what, what it was about, the state it moved from and to, and the detail as it was logged.

It opens on the last 7 days. Who set to Everything, Reelwire's own steps too adds every step Reelwire took with every post, which is most of the log; the default, People and API keys, leaves them out, because an auditor's first question is about people. The audit log keeps what happened; the record above keeps what a post said, in full.

Auditors

People from outside your workspace, such as your compliance officer, an external auditor or a regulator's examiner, who sign in to read the compliance record, its export and the audit log, and the rest of the workspace without changing anything.

• They take no seat, and are not on Team. A workspace has at most 5.
• Compliance is their only menu entry, and where they land when they sign in.
• Added and removed by somebody holding Administration. Add auditor takes an address and an optional name. They are sent the same email a colleague gets, with a link to set their own password, and the next screen shows a one-time password with Copy, once, in case the email does not reach them. Resend link sends a new link, which replaces the one before; Remove signs them out and deletes their account, and they are told. What they did stays in the audit log.
• Locked out when the workspace leaves Enterprise, at once: an auditor is there for the record.

The card lists each auditor's address, name and last sign in.

Kept ten years, and what happens when you leave Enterprise

Every entry is kept ten years from the day it was written, whatever happens to the clip, the post, the channel or the person since, and then deleted with its frames.

A workspace that leaves Enterprise, by moving to a smaller plan or because its subscription ended, records nothing new from then on, and keeps what it has 90 days more, for a last export. Its owners are emailed at once, "Your compliance record is kept until" the date, and again a week before, "Your compliance record is deleted in a week". These emails cannot be switched off. Meanwhile the screen stays in the menu with a warning at the top, and the record can be read, exported and checked against a video; the Approval rules and Auditors cards are gone, and auditors can no longer sign in. Moving back to Enterprise before the date keeps the record as it was, and it carries on. After the date it is deleted: Reelwire is not an archive for former customers, and the export is your own copy, which checks without us.

A workspace that is deleted takes its record with it. Download the export first.

What people get wrong

"The video from Instagram does not match." It never will: a platform re-encodes what it publishes. Check the file the workspace received, which is the one to keep.

"The newest entries are not time-stamped yet." They are sealed and signed within seconds, and the next daily time stamp covers them. An export says up to which entry the last one reaches.

"Where is the video?" The record keeps the video's fingerprint and three frames of it, not the clip, which leaves storage within weeks. The fingerprint proves which file it was; keeping the file is yours to do.

"I wrote it and cannot approve it." On Enterprise nobody approves their own post or change. Ask somebody else who holds Approvals.

From your own code, or an assistant

A key with the Compliance: read permission reads the record, checks a fingerprint against it and downloads the export, for an archive of your own: see Compliance in the API reference. The approval rules and the auditors are a signed-in person's, never a key's. An AI assistant reads the record and the audit log with reelwire_compliance.