When a regulator acts on a finding, the first question from the other side is always the same: prove it looked like that when you saw it.
Screenshots alone don't survive that question. A screenshot shows what a page rendered, not what was served — and it can't show that nothing was altered afterwards.
What we capture instead
Every observation Helios makes is stored as a web archive with a cryptographic fingerprint, timestamped by an independent third party at the moment of capture. The evidence chain records:
- What was served — the full response, not a rendering of it
- When it was captured — an RFC 3161 timestamp from an independent authority
- Where it was observed from — the exit location is verified on every capture
- Who touched the record afterwards — an append-only audit trail
Observations, not determinations
Helios findings are observations. Whether an operator is unlicensed in a jurisdiction is a determination only the regulator makes — our job is to ensure the evidence underneath that determination holds up months later, in front of people motivated to dispute it.
That's why the archive comes first, and the judgement second.