A record is only worth keeping if nobody can quietly change it.
Vordr treats a signed inspection the way a bank treats a statement. What follows is how that is enforced, in plain terms.
When the venue contact signs, the record closes. No field can be edited afterwards, by anyone, including global admins. A correction is a new record that points at the original.
Arrival and distance from the venue, each retry, each custody change, the signature and the moment the office received it. Times are recorded on the device and reconciled on sync.
A device is Deployed, Faulty or Retired because of what happened to it, not because somebody set a field. The estate view is recomputed from events on every read.
Every record names the template version it was answered against. Published questions cannot change key or type, so a report over twelve months compares like with like.
Technicians see their own surveys and nothing else. Admin actions are gated by capability, not by page. Invitations expire and cannot be reused.
The signed PDF carries the record id, the seal time, signer and witness. Anyone holding it can be shown the same record in Vordr.
Plain sentences, exact times.
This is the right-hand column of every inspection record.