Timing, accounts, language, coordination — if it’s an operation, we name it.
STEP 3
Your lawyer gets a sealed pack
Evidence no one can quietly edit — verifiable by anyone, even offline.
You don’t need to understand the cryptography. Your lawyer’s expert will — and anyone can verify everything without trusting us.
THE TIME-LOCK
Sealed in time — timestamped by DigiCert.
The moment your evidence is sealed, its fingerprint is timestamped by DigiCert — one of the world’s most trusted certificate authorities. From that second, nobody can backdate it or quietly rewrite it. Not the attacker. Not the platform. Not even us.
RFC 3161 · DigiCert primary, independent fallback authorities · every token verified before acceptance
BUILT ON THE STANDARDS COUNSEL AND PLATFORMS ALREADY TRUST
SHA-256·Merkle proofs·RFC 3161·DSA Art. 16·X.509 TSA chain·GDPR / EU residency
01
You’re not paranoid.
If the attacks are coordinated, we connect the surfaces and name the operation — and if the data doesn't support coordination, we tell you that too.
02
Trust the math.
Every pack is third-party verifiable — re-derive the JCS hash and Merkle root yourself. The evidence never depends on trusting us.
03
A controlled way out.
One secure upload. We draft and hand off to counsel — we never auto-remove and never guarantee deletion.
EVIDENCE PACK // TRUST THE MATH
Don’t trust us. Verify it yourself.
Three open standards seal every pack. Re-derive the canonical hash and the Merkle root in your own tooling — tamper with a byte and the seal breaks, visibly.
CHAIN OF CUSTODY · 6 ARTIFACTSREPLAY · ILLUSTRATIVE
RFC 8785 JCS HASH—
RFC 6962 MERKLE ROOT—
RFC 3161 TIMESTAMP2026-06-30T14:02:11Z
✓
SEAL VALID
re-derived root matches
RFC 3161, non-qualified · existence-at-time only. Not eIDAS-qualified — no QTSP contracted.
RFC 8785
Canonical JSON (JCS)
One exact byte-form to hash, so any party derives the identical digest.
RFC 6962
Merkle tree
A single root that exposes any change to any artifact in the pack.
RFC 3161
Trusted timestamp
An independent authority signs existence-at-time. Non-qualified today.
CROSS-DOMAIN LINKAGE //
We link only independently confirmed attacks. Never two activity spikes.
Attribution is a mechanism, not a guess. Four independent axes must corroborate before a surface joins an operation.
Coordinated timing windows that exceed plausible coincidence.
NARRATIVE
Convergent framing and reused phrasing across surfaces.
ACTOR
Behavioral signatures that bind accounts to a common operator.
False-positive control: a surface is linked only when independent axes corroborate. A single spike never establishes linkage. Built mechanism, unit-tested — not a proven real-world result.
THE BRAIN // CAPABILITY, NOT OUTCOME
Twenty-two engines. Each one bounded by design.
Every engine reports a hard fact about its mechanism — never a detection rate. Detection performance is unverified by any benchmark, and we don't publish a score we can't externally prove. Six of the twenty-two, in detail below — one hard fact each.
AI-assisted, never AI-decided — every dossier carries an EU AI Act Art. 50 transparency notice and a countersignature field for counsel's human review.
HOW IT WORKS //
One secure upload. We detect, seal, and draft — your counsel files.
STEP 01
Upload
Encrypted intake. You share the URLs and context once.
STEP 02
Detect
We corroborate the operation across four independent axes.
STEP 03
Seal
Capture is hashed (8785), Merkle-anchored (6962), timestamped (3161).
STEP 04
Hand off
We draft and hand off to counsel. We never auto-remove or guarantee deletion.
FOR COMPANIES // GC · CISO
Tamper-evident evidence built to be challenged — every hash re-derivable by the other side.
Admissibility panel
✓Chain of custody — every artifact hashed and time-anchored at capture.
✓Challenge-ready — the seal algorithm is source-available at /verify; every hash is re-derivable by opposing counsel, and each finding states its own limits.
✓DSA Art. 16 — notice-and-action hand-off package for platforms.
HONEST LIMITS
Company right-to-be-forgotten does not exist — GDPR Art. 17 applies to natural persons only. The real levers are DSA Art. 16 notice-and-action and named-director complaints.
We draft and hand off. We never submit on your behalf and never guarantee removal.
FOR INDIVIDUALS // DISCREET
This is a coordinated operation. We name it, prove it, and give you the evidence to act.
WHAT IT FEELS LIKE
"Sudden wave of 1★ reviews"
"Anonymous accounts, same story"
"A seeded article climbing search"
WHAT IT ACTUALLY IS
NAMED OPERATION · LS-7Q4M · ILLUSTRATIVE
One operator. Eight surfaces. Sealed.
The vindication pivot: scattered, shameful noise becomes a single named, provable operation you can hand to counsel.
Honest limit: for public figures, right-to-be-forgotten requests tend to fail. We focus on what works — naming the operation, sealing the evidence, and the levers your counsel can actually pull.
PRICING // THE PRUDENT MOVE
A screening is €19. Removals cost €90 — and only if the review comes down.
COST OF INACTION · ILLUSTRATIVE MODEL
€
Modeled exposure per day€4,000
Your number, our arithmetic (monthly ÷ 30). Illustrative only — no fabricated figures, no countdown.
Priced per contested review, so you only pay for what you actually dispute: sealed forensic report, DSA Art. 16 notice draft, DigiCert-timestamped seal, public verifier bundle. Bought in one click from your screening. Start with a screening →
PAID ON RESULT
Removal — €90 per review taken down
Charged only when a re-scrape confirms the review is gone. If it stays up, you pay nothing for it. A lawyer bills you whether they win or lose — we don't.
Agency / white-label
We stay invisible, you keep the credit. Agency 100 · €1,400 and wholesale 500 · €7,000 packs. kontakt@legalsandwich.com →
TRUST CENTER // GATED
Procurement artifacts for the buying committee.
Security & methodology
Architecture, data-handling and retention for captured hostile content, GDPR/DPA, EU residency. No SOC 2 / ISO certification yet — we are early; security architecture and data-handling documentation available on request.
Offline verifier
Downloadable independent verifier + a tamper-test sandbox. Re-derive any pack with zero dependence on us. Open the verifier →
Case studies
We have no public case studies yet — we are early, and we say so instead of inventing one. A sample dossier on clearly fictional data (“Ristorante Fittizio”, permanently watermarked FIKTIV) is published at /lawyers — including a sealed bundle you can re-verify at /verify.
PARTNER FLOW · WHITE-LABEL
White-label Evidence Packs and SLAs for agencies and law firms acting for clients — your engagement, our forensic layer underneath. We stay invisible. You keep the credit.
Run a screening yourself — sign in with e-mail, point it at a public review profile, and get an observational map of what stands out. Indicators, never verdicts.
No sales call. Looking around is free; a screening costs 1–2 credits (First Screening €19). The scan reads only publicly visible reviews. What it finds is described in observational language — patterns marked for review, not accusations.
We draft and hand off to counsel — we never auto-remove and never guarantee deletion. No one can honestly guarantee removal, including us — treat a removal “guarantee” as a red flag; it is a documented pattern in reputation-extortion schemes. RFC 3161 timestamps are non-qualified (existence-at-time only).