Build a cold-chain chain-of-custody log with digital signature and immutable audit trail for regulated pharmaceutical shipments

Verified steps

1. Define a chain-of-custody event schema including: event type (handoff, departure, arrival, temperature check, excursion, disposition), timestamp UTC, location (GPS or facility ID), actor (carrier SCAC or employee ID), shipment ID, and logger device IDs active at event time
2. On each handoff event, collect the outgoing party's digital signature (e.g. carrier driver scan or digital acceptance confirmation from carrier API); record as a Base64-encoded field alongside the event
3. Store each event as an immutable append-only record using Amazon QLDB or equivalent ledger database; reject any update or delete operations at the application layer; use QLDB's built-in document hash chain for tamper evidence
4. Compute a SHA-256 digest of the serialized event payload before writing; store the digest with the record so downstream consumers can verify payload integrity without relying solely on the database layer
5. At shipment completion, generate a chain-of-custody report by querying all events for the shipment in sequence order; include the MKT calculation result, all excursion events with duration, and all handoff signatures in the final report
6. Export the complete chain-of-custody package as a signed PDF or structured JSON document and store in a long-retention archive (minimum 7 years for GDP-regulated pharmaceutical shipments)