AccessLedger

Inspiration

Accessibility is the law almost everywhere a company ships, and enforcement plus lawsuits keep rising. Existing tools generate alt text or flash a "compliant" badge, but when an auditor shows up they ask for the one thing those tools never produce: proof of who approved what, and when. We built that evidence layer.

What it does

A company uploads the visual content it already publishes. AccessLedger drafts the accessible versions the law requires: an audio description, a plain-language version, and a compliance report of the machine-measurable metrics. The AI is deliberately the least important part. It measures what a machine can measure and leaves the real judgment calls to a qualified human reviewer, who adjudicates and signs off per criterion. The signed attestation and a hash-verified provenance manifest are then sealed on Backblaze B2 under Object Lock (WORM), so the record is immutable. Anyone can run Verify, which re-downloads every artifact from B2 and re-checks its hash node by node.

How we built it

Next.js 14 on Vercel, FastAPI on Render, PostgreSQL. Every generative step runs through a single Genblaze pipeline into one hash-verified manifest on B2. Backblaze Object Lock (COMPLIANCE) enforces the immutability at the storage layer, so the guarantee does not depend on our own code. Audio description via ElevenLabs, simplified text via GPT-4o, readability scoring server-side. The reviewer signs the attestation with a non-extractable ECDSA P-256 key created in their browser, so the server never holds it and the sign-off is non-repudiable.

Challenges we ran into

Making the immutability claim real instead of decorative. We delegated enforcement to B2 Object Lock and built a live proof: it attempts to delete a sealed record and shows Backblaze rejecting it with AccessDenied, while an unlocked control object with the same credentials deletes cleanly, isolating Object Lock as the cause. We also caught a subtle bug where a version-less delete only added a delete marker and looked deletable; targeting the specific object version fixed it.

Accomplishments that we're proud of

A working chain of custody from the source image to a human signature, sealed on B2, with a live Verify and immutability proof that would visibly fail if any byte changed.

What we learned

Storage can be the product. Using Backblaze Object Lock as the trust anchor, rather than incidental file storage, is what turns "we generated something" into "here is proof no one can alter."

What's next

Binding the reviewer's key to a verified identity (SSO / passkey attestation) and adding an RFC-3161 trusted timestamp, for full institutional-grade non-repudiation.

Built With

• backblaze-b2
• elevenlabs
• fastapi
• genblaze
• gpt-4o
• next.js
• object-lock
• openai
• postgresql
• python
• render
• tailwindcss
• typescript
• vercel
• webcrypto