▸ Communication

Messaging & Audit Trail

Every conversation between venues, artists, agents, and crew lives in one place — with a tamper-evident audit log that protects everyone when disputes arise.

Why This Exists

Most show conversations happen across five different channels: email, text, WhatsApp, Slack, Instagram DM. When something goes wrong — a guarantee dispute, a no-show, a damaged green room — the people who need to resolve it have to piece together months of fragmented messages to figure out what was actually agreed to. Sometimes screenshots are doctored. Sometimes messages are deleted. Sometimes one side has receipts, the other doesn't.

We built a single threaded messaging system that lives next to the show itself. Every message, every edit, every contract signing, every status change is recorded in an immutable audit log. If a dispute happens, both parties have access to the same verified history.

Threads

A thread is a conversation. Three types:

The Audit Log

Every action in a thread creates an immutable audit entry:

• Messages sent, edited, or deleted
• Files attached (each entry carries the file's SHA-256, never its name)
• Participants joining or leaving
• Contract signings (each carries the terms hash the signature binds)
• Thread freezes (legal holds) and archives
• Exports generated

Tamper-Evidence

Each audit entry stores the SHA-256 hash of the previous entry, forming a hash chain. If anyone modifies a past entry, the chain breaks and any subsequent verification fails. Every export comes with a chain root hash that can be independently verified against the live audit log.

{
  "id": 14,
  "thread_id": "th_sample_set_06_06",
  "actor_user_id": "u_zach",
  "actor_name": "Zach Mendelsohn",
  "action": "contract_signed",
  "details": {
    "memo_id": "dm_sample_set_offer",
    "terms_hash": "0xa83f...2b91",
    "signature_hash": "0x51c0...77de",
    "party_role": "venue_admin",
    "org_type": "venue"
  },
  "ip_hash": "0x3f4d...",          // SHA-256 of IP, never raw
  "user_agent": "desktop/Mac",
  "occurred_at": "2026-04-12T19:47:00Z",
  "prev_entry_hash": "0x9bf2...",
  "entry_hash": "0xfae3..."
}

Legal Hold (Freezing a Thread)

If a dispute is filed — or a venue/artist requests a freeze for any reason — the thread can be frozen. When frozen:

• No new messages can be added
• No existing messages can be edited or deleted
• The full message history and audit log remain accessible to everyone still on the thread
• Freezing does not restore access to anyone who has left or been removed — a thread refuses anyone whose participation has ended, and a frozen thread is no exception
• Any participant can still request a sealed export of the record

Exports for Legal Use

Any participant can request a sealed export of an entire thread, delivered as a downloadable snapshot. The export includes:

• The full message history with edit metadata
• The complete hash-chained audit log, where every edit, deletion, freeze, and export is a linked entry
• The participant list
• The verified chain root hash, recomputed at export time and recorded in BandPass's append-only platform event log, held outside the messaging tables

An export only seals if the thread's hash chain verifies end to end. The sealed root is also copied into a separate append-only platform log outside the messaging tables, so a rewritten thread can't be made to match a previously sealed fingerprint. That recomputable fingerprint is what a dispute relies on to show the record wasn't altered after the fact.

Files

A message can carry up to five files of up to 25 MB each: PDF, JPG, PNG, WebP, Word, Excel, TXT and CSV. BandPass decides what a file is from its contents, not its name, and refuses anything else. Files are private: only the people currently in the conversation can download them (everyone seated, in a show thread), someone who leaves loses access, and a deleted message's files can no longer be downloaded. BandPass does not scan files — only open files from people you trust.

Each file's SHA-256 is part of its message's hash, and verifying or exporting a thread re-reads every file and checks it against that hash, naming any file whose stored copy no longer matches — an export will not seal over one. When a person's account is deleted, the files they sent are deleted too; the record keeps each file's hash and size, marked removed, so the thread still verifies.

Privacy

Other parties' messages are visible only to other thread participants and (for compliance reasons) BandPass administrators with audit-access role. We do not train AI models on message content. We do not share message content with third parties except in response to a valid legal subpoena, and we will notify you of any such request unless legally prohibited.

IP addresses are hashed before storage — we never log raw IPs. User-agent strings are coarsened to desktop/Mac, mobile/iOS, etc.