Your Screenshots Won't Save You: Records That Survive a Dispute

There is a moment in every dispute where somebody says we've got screenshots. And there is a second moment, usually a few minutes later, where everyone realises those screenshots are four PNGs in a folder called stuff, taken at some point, by someone, on a laptop that has since been replaced.

I don't say this to be unkind. Screenshots are how normal businesses document things, and for nine cases out of ten they are perfectly adequate. But the tenth case — the insurance claim, the client threatening legal action, the ICO enquiry, the audit that lands in your inbox with a deadline — is exactly the case where a screenshot stops being evidence and becomes merely a picture of a claim.

What a screenshot can't tell anyone

A screenshot answers one question: this is what a screen looked like at some point. It cannot tell you who took it, when, whether it has been edited, or whether the system it came from has changed since. Metadata helps, right up to the moment the file is dragged into a chat app, re-saved, or pasted into a document — at which point it quietly evaporates.

Evidence, in the sense that a solicitor or a regulator means it, answers a different set of questions. What is the record? When did it exist? Has it changed since? Who has held it? If you can't answer those four, you have a story, not a record.

The good news is that tamper-evidence is not an enterprise luxury. It is a handful of habits built on tools most UK small businesses already pay for.

Hashes: the least glamorous useful thing you own

A cryptographic hash is a short string of characters produced from a file. Change one comma and the string changes completely. It doesn't keep anything secret — it's a fingerprint, not a lock.

That is all you need. Export the record (a PDF of a change approval, a CSV of deleted accounts, a signed acceptance email), hash it, and store the hash somewhere separate from the file. If anyone later questions whether the document was altered, you re-hash and compare.

On Windows, Get-FileHash does it. On a Mac, shasum -a 256 filename. Both produce a result in under a second. Write the hash into a log with the filename and the date, and you have the beginnings of a chain.

Trusted timestamps for people who don't want a maths degree

A hash proves integrity. It doesn't prove when. For that you want a trusted timestamp — a service that takes your hash and signs it with a time from an independent source. Several UK and EU providers offer this at pennies per record, and some document management platforms bake it in.

Is a trusted timestamp overkill for a five-person agency? Possibly. A dated entry in a log that is written once and never edited, plus a hash, covers a lot of ground. But if your contracts involve service credits, regulatory deadlines or insurance claims, paying a few pounds a month for independent time is a cheap way to stop an argument before it starts.

Write-once storage you already have

Object storage from any major cloud provider offers an immutability setting — sometimes called object lock, sometimes retention, sometimes legal hold. Switch it on for one bucket, point your records at it, and set a retention period you can defend. After that, nobody — including you, including an admin — can quietly overwrite or delete the file until the clock runs out.

That last point matters more than people expect. The most common challenge to a record isn't you forged it, it's you could have edited it at any time. Write-once storage closes that door permanently, and it costs a rounding error per month.

If cloud storage feels like too much, a monthly PDF export emailed to two named people and stored in separate systems is crude but surprisingly durable. Crude beats absent.

The short list of records worth sealing

Not everything deserves this treatment. Sealing your lunch orders will bury the signal. Seal the things that would be argued about later:

• Change approvals — who authorised the deployment, when, and what was in scope.
• Data deletion confirmations — an erasure request fulfilled under UK GDPR, with the date and the systems covered.
• Access revocations — the leaver checklist, signed off, proving the accounts were actually closed.
• Backup and restore test results — because insurers increasingly ask.
• Client sign-offs — acceptance of deliverables, especially where payment is staged.
• Incident timelines — what broke, when it was noticed, when it was fixed.
• Vendor notices — breach notifications, sub-processor changes, terms updates you were told about.

Seven categories. If your team can produce a sealed record for each of those on demand, you are in better shape than most organisations ten times your size.

Retention: decide, then stop

A record you keep forever is a liability with a nice filename. UK GDPR expects you not to hold personal data longer than necessary, and your evidence trail is no exception.

Agree a period per category, write it down, and let storage expire on its own. Change approvals: two years. Incident records: three to six. Contracts and financial records: seven, for the accountants. Deletion confirmations: long enough to answer a complaint, which usually means three years.

The discipline is in the deletion, not the keeping. A retention schedule nobody enforces is just an accumulation habit with extra steps.

One paragraph of chain of custody

You do not need a formal custody register for a twelve-person company. You need a sentence.

Exported from the finance system on 3 September 2026 by A. Patel, hashed, stored in the locked bucket, copy held by the operations lead.

That is it. Who made it, when, where it lives, who else holds it. If the record travels — handed to a solicitor, sent to an insurer — add a line each time. Three sentences is a chain.

The honest limits

None of this turns you into a forensics lab. A determined challenge to any record is still possible, and a small team will always rely on ordinary professional judgement rather than formal procedure.

But there is a wide gap between we've got some screenshots somewhere and here is the file, here is the timestamp, here is who held it. That gap is where claims get paid, audits get closed and complaints get resolved without a solicitor.

Seal the seven things that matter. Hash them, timestamp them, lock them, and write one sentence about who did what. It costs an afternoon and it is the most quietly useful hour of admin your team will do this year.