Built to Withstand Scrutiny
CoralLedger Comply is designed against primary legislation, mathematically deterministic, and built around a hash-chain audit trail. Cryptographic sealing of every sign-off is the platform’s design target and is under final verification ahead of beta launch.
Compliance Workflow Controls
Each pillar addresses a distinct risk that VAT filers and auditors face. Together they support practitioner review of return preparation and records.
Designed to Statute
VAT engine and audit trail built against the VAT Act 2014, 2026 Amendment, and DIR Form 32a v2.4. No completed independent regulatory review is represented here.
Hash-Chain Audit Trail
Hash-chained records that, by design, cannot be altered without detection. Chain verification is under final verification ahead of beta launch.
Practitioner Attestation
Dual-condition gate supports practitioner attestation.
Design Basis and Review Limits
CoralLedger Comply’s VAT calculation engine, attestation workflow, and audit trail were designed against the primary legislation - the Value Added Tax Act 2014, the Value Added Tax (Amendment) Act 2026, and DIR Form 32a v2.4 - with internal regulatory analysis cross-referencing each calculation to its statutory provision.
No completed independent regulatory review is represented here.
-
✓
VAT calculation logic is anchored to the VAT Act 2014, the April 2026 amendments, and DIR Form 32a v2.4
-
✓
Rate classifications cover standard-rated, reduced-rate, zero-rated, and exempt supply categories
-
✓
Apportionment methodology guidance is held pending final engineering and citation review
-
✓
Attestation workflow is built around the practitioner attestation requirements
-
✓
Audit trail uses a hash-chain architecture
What the Audit Trail Terms Mean
CoralLedger Comply uses precise, legally meaningful terminology in every audit record. Understanding these terms helps practitioners, auditors, and business owners interpret the evidence package confidently.
Audit Entry
A single, timestamped record that captures an action performed on a VAT return or transaction - who did it, what changed, and when. Every audit entry is individually hashed.
SHA-256 Hash
A cryptographic fingerprint generated from an audit entry's content. If even one character in the entry is altered after the fact, the hash changes. That is why the platform's hash-chain design is intended to detect tampering once verification is complete.
Chain Link
Each audit entry is designed to include the hash of the preceding entry, forming an unbroken chain. Deleting or reordering entries is intended to sever the chain and be detectable during verification.
Tamper Event
A detected break in the hash chain. Chain-verification observability is under final verification; when active, tamper events surface in the Audit Defense Dashboard with the exact entry where integrity was lost and the downstream records affected.
Chain Integrity Status
An integrity indicator used to confirm whether audit entries from creation to present remain unaltered. Continuous production verification is under final verification before this status is advertised as live evidence.
Timestamped Record
An audit entry sealed into the platform's hash-chain design. Once production signing and chain verification are fully confirmed, no user - including platform administrators - should be able to modify a sealed entry without detection.
Practitioner Attestation You Can Stand Behind
CoralLedger Comply records the practitioner's self-declared standing and typed capacity. This record does not verify credentials or confer authority to act.
Standing Declaration
The practitioner records their self-declared standing.
Typed Capacity
The practitioner states the capacity in which they attest.
Timestamped Record
A timestamped attestation record is written to the audit trail.
Prefill Attribution
The return records the practitioner's self-declared name and standing.
The prefill requires both assignment and attestation. Active client assignment AND active attestation profile must both be present. A workload assignee who is not the named practitioner of record never receives the prefill - by architecture, not by policy.
Cryptographic Sign-Off Sealing Is Under Final Verification
Every sign-off will be cryptographically sealed once production signing is enabled. The signing pipeline and chain verification are under final verification, while row-level deletion immutability remains under engineering review for Addendum 1.
One Dedicated Record Per Return
When a VAT return is attested, CoralLedger Comply creates a separate attestation record distinct from the underlying transaction log. Engineering verification of the immutable-storage implementation is tracked in Addendum 1 before any absolute claim is made.
Timestamp and Signatory Capture
Each attestation record captures the UTC timestamp, the identity of the signatory, the signatory's declared authority (e.g. director, BICA practitioner), and the filing period covered.
Linked to the Return Snapshot
The attestation record references the exact state of the return at the moment of signing - if the underlying figures are ever queried, the system can reproduce the return as it appeared when attested.
Included in Every Audit Export
Attestation records are exported as a structured component of the Audit Defense Package - auditors receive both the return data and the evidentiary record needed to validate signatory confirmation once production signing verification is complete.
Designed (AA-049): Attestation records are implemented as a separate tenant-scoped entity. Body-text content is designed to be tamper-evident via SHA-256 hash; row-level deletion immutability remains under engineering verification.
Evidence - body-text tamper evidence:
The Attestation entity in the CoralLedger Comply application's domain layer
is a separate tenant-scoped entity (distinct from the transaction log) via a
required BusinessId field. Its body text carries a SHA-256
TextVersionHash over BodyId|Version|BodyText, computed
at creation and recomputable on read. Production signing for every attestation
remains under final verification; implementation references will be cited in the
public engineering addendum.
Evidence - pending Addendum 1: Row-level deletion immutability and any inter-record hash-chain claim require additional engineering verification and will be cited in Addendum 1 alongside the attestation-workflow review.
Supplies Outside Supported Scope
These two supply types are outside the supported scope of CoralLedger Comply.
Real estate deposits
Real estate deposits straddling a rate-change date are outside the supported scope of CoralLedger Comply. No attestation pathway or override is available for these supplies.
Rate-spanning continuous supplies
Rate-spanning continuous supplies are outside the supported scope of CoralLedger Comply. The platform does not calculate their apportionment, and no attestation pathway or override is available.
No attestation pathway or override is available for these supplies. Seek advice from the Department of Inland Revenue about obligations outside the supported workflow.
Frequently Asked Questions
What is a "compliance posture"?
A compliance posture is the sum of technical, procedural, and evidential controls a system puts in place to support review of calculations, attestations, and records against the relevant law. CoralLedger Comply's posture is built on four pillars: deterministic calculation, tamper-evident audit trails by design, recorded practitioner attestation, and per-return sign-off records under final verification.
Can a user or administrator alter an audit record?
By design, no sealed audit entry should be modifiable by any user - including platform administrators - without changing the entry's hash and breaking the chain. Production signing and chain verification are under final verification, so this page describes the intended control rather than a completed production attestation.
How is the practitioner’s standing recorded?
Practitioners record their self-declared standing during onboarding. That standing is stored against the practitioner profile and is included where the prefill pathway activates. Activation requires both an active client assignment and an active attestation profile.
Are carve-out supplies excluded from the prefill?
Yes. Real estate deposits straddling a rate-change date and rate-spanning continuous supplies are outside the supported scope. No attestation pathway is available and the platform does not calculate their apportionment. No override is available for these carve-outs.
Has the platform been independently reviewed?
CoralLedger Comply was developed against the primary legislation - the Value Added Tax Act 2014, the Value Added Tax (Amendment) Act 2026, and DIR Form 32a v2.4 - with internal regulatory analysis cross-referencing each calculation to its statutory provision. No completed independent regulatory review is represented here.
Compliance You Can Demonstrate
Return preparation, audit-trail design, and recorded practitioner attestation. Join the beta waitlist; we’ll email you as access opens.