Hash-chained. Alter, delete, or reorder a single entry and every downstream hash stops matching — the break is mathematically obvious.
JUNE 8, 2026 / COMPLIANCE / UPDATED OCTOBER 17, 2026
Label Compliance Software: An Immutable, Hash-Chained Audit Trail for Regulated Labeling
Label compliance software: hash-chained print audit trail, re-authenticated e-signatures and label provenance. Part 11 style controls on Enterprise.
FREE PLAN · NO CREDIT CARD · WINDOWS / MAC / ANDROID / WEB
Native printer languagesZPL, TSPL, TPCL, ESC/Label
No driver to installUSB, network or Bluetooth
Every platformWindows, macOS, Android, web
Free to startNo credit card, 14-day trial
THE PROBLEM
In a regulated environment, the label is part of the record. When an auditor or investigator asks "exactly what did you print, who approved it, and can you prove it hasn't been changed?", a screenshot and a spreadsheet are not an answer.
LabelInn was built so that the answer is always: yes, here is the cryptographically verifiable history. Print records are immutable by database rule, hash-chained and signed so tampering is detectable, and gated behind re-authenticated electronic signatures — the technical controls a FDA 21 CFR Part 11 / EU Annex 11 style program depends on.
Audit-ready by design. Immutable print history, a self-verifying hash-chained log, and re-authenticated e-signatures. Compliance mode and audit logs are Enterprise features, and the 14-day trial includes them so you can test them on your own labels. Start free →
THE AUDIT TRAIL, CONCRETELY
What one audit record holds, and how an auditor checks the chain
"We keep an audit trail" is not an answer until you can say what is in one record and how someone who does not trust you would check it.
The fields of a record
| Field | What it holds |
|---|---|
actor | Who did it: a user, an API key, an automation rule, the system or an edge device, with id and name. |
action | What happened: print, cancel, reprint, verify, verify_fail, rule_trigger, config_change, printer_status or system. A reprint is recorded as a reprint, not as a second print. |
resource | What it happened to: a job, a printer, a design, a rule or a configuration. |
details, dataHash | The event's own data and a hash of the payload it concerns. |
seq, prevHash | The record's position in the chain and the hash of the record before it. The first record uses the marker GENESIS. |
contentHash | SHA-256 of the record's canonical body (every field above, keys in fixed order), so the same record always hashes the same way. |
signature, signatureKid | An HMAC-SHA256 over the content hash with a per-company key, and the id of the key used, so keys can rotate without invalidating old records. |
How a chain is verified
- Take the records in
seqorder. - Recompute each record's
contentHashfrom its canonical body. A record whose stored hash differs has been altered. - Check that each record's
prevHashequals the previous record'scontentHash. A gap or a reorder breaks this. - Check the HMAC signature. A forged record that carries a correct hash still fails here without the company key.
The API exposes the chain: GET /v1/audit/trail pages through records, GET /v1/audit/print-history/:jobId returns one print with the values of every element, and GET /v1/audit/verify-chain verifies a range.
Questions an auditor asks, and where the answer is
| Question | Where the answer is |
|---|---|
| Who printed this label, and from which integration or key? | The print record's actor and the job's origin (channel, integration, API key, workflow). Network addresses are deliberately not copied into the chain. |
| What values were on it? | The per-element saved-versus-printed values on the print-history record. |
| Was it a reprint? | The action field: reprint, not print. |
| Did someone change the design or a rule after approval? | config_change records name the actor and the resource changed. |
| Has any record been altered or removed? | Run the chain verification over the date range. |
What the chain does not prove
- It shows a record was not changed after it was written. It does not show the data typed into the label was right.
- It does not validate your process. IQ, OQ and PQ, procedures and training remain yours.
- Personal-data erasure requests do not touch the audit trail, which is why raw network addresses are kept out of it. Decide what personal data you put in label fields with that in mind.
- Compliance mode and audit logs are Enterprise features. The 14-day trial includes them.
HOW IT WORKS
Three screens from data to printed label.
No copy-paste, no hunting for templates. The same flow repeats for every record.
Printer status, quick actions and recent work in one place.
Text, barcodes, QR and images placed on the real media size.
See the label, the printer state and the copy count before it prints.
01
What "compliance" actually requires — and how LabelInn enforces it
| Control a regulated program needs | How LabelInn enforces it |
|---|---|
| Records can't be quietly edited or deleted | ✓ Immutable print history — enforced by database rules, not just app convention |
| Tampering must be detectable | ✓ SHA-256 hash-chained + per-company HMAC-signed self-verifying audit log |
| Signatures bound to a specific person + action | ✓ E-signature approval requiring fresh re-authentication at the moment of signing |
| Prove what was actually printed | ✓ Per-element saved-vs-printed capture + raw print-payload capture |
| Reconstruct a past label's full history | ✓ Label provenance reconstruction — design, data, operator, bytes sent |
| Limit who can do what; protect personal data | ✓ RBAC (owner/admin/editor/operator/viewer) + PII gating |
| Know which plan carries it | Compliance mode (e-signatures, Part 11 style controls) and audit logs are Enterprise features; the 14-day trial includes them. See the plan table below. |
02
1. Immutable print history — enforced at the database layer
The weak point in most "audit trails" is that the application says it won't change a record — but the underlying store still allows it. LabelInn enforces immutability with database security rules: once a print event is written, it cannot be updated or deleted, regardless of which client, API key, or user attempts it. The record is append-only by construction, not by good behavior.
03
2. A self-verifying, hash-chained audit log
Every entry in the print history is linked to the one before it. Each record stores the SHA-256 hash of the previous record, forming a chain, and the whole entry is signed with a per-company HMAC key. The result is a log you can independently re-verify at any time.
HMAC-signed per company. Signatures are keyed to your organization, so records can't be forged or transplanted from elsewhere.
Self-verifying. Re-run the chain on demand to produce a clean proof that the history is intact — exactly the kind of evidence an auditor wants to see.
04
3. E-signature approval that re-authenticates the signer
A signature only means something if it's bound to a real person at a real moment. LabelInn's label-approval e-signature requires a fresh re-authentication: the signer re-enters their credentials at the point of signing, so the approval is attributable to that individual and that specific action — not to "whoever happened to be logged in." This mirrors FDA 21 CFR Part 11 / EU Annex 11 style expectations for electronic signatures on regulated approvals.
05
4. Per-element saved-vs-printed capture
"We printed the approved design" isn't enough on its own — data-driven labels change at print time. LabelInn captures the saved-vs-printed state per element and stores the raw print payload that went to the printer. So you can show not just which template was used, but the exact field values, substitutions, and bytes rendered on a given run.
06
5. Label provenance reconstruction
Put the pieces together and you can rebuild the complete story of any historical label during an audit or investigation:
- Which design and revision produced the label
- What data values populated each element at print time
- Who initiated and who approved the print (with the re-authenticated signature)
- What raw payload was actually sent to the printer
- Where it sits in the verified chain, proving the record is original and untampered
07
6. Role-based access control + PII gating
Compliance isn't only about records — it's about controlling who can act. LabelInn enforces role-based access control across five roles (owner, admin, editor, operator, viewer), checked in both the database security rules and the callable backend functions. Personal data is PII-gated so it's only visible to roles that should see it. Teammates are invited by email and slotted into the right role; an operator can print without being able to alter approved designs or read protected fields.
Built for chemical, food and pharma labeling. Pair the audit trail with the GHS/CLP hazard-label engine for end-to-end regulated output. See the GHS/CLP engine →
08
Which plan has the audit trail and e-signatures
Which plan carries which part is easy to get wrong when you read marketing pages, so this table is taken from LabelInn's plan-entitlement data, the same data the app and the backend check. Prices are the published list prices.
| Capability | Free | Starter $7.99/mo | Pro $24.90/mo | Enterprise |
|---|---|---|---|---|
| Print history | 30 days visible | Full archive: who printed what, any date | Full archive | Full archive |
| Visual workflows | No | 2 saved workflows | Unlimited | Unlimited |
| API and webhooks (production use) | Read-only sandbox | Sandbox only | Yes | Yes |
| Compliance mode (e-signatures, Part 11 style controls, GHS presets) | No | No | No | Yes |
| Audit logs | No | No | No | Yes |
| Design and print approval queue | No | No | No | Yes |
The 14-day trial includes every row, so you can run a real approval and verify a real chain before you ask for an Enterprise quote. Enterprise is quoted per deployment; talk to us or see full pricing. Plan limits can change, so the pricing page and your account are the source of truth.
09
Compliance is one capability of a programmable label platform
The audit trail doesn't live in isolation. It sits inside a platform you can automate and integrate:
Cloud REST API — POST /v1/print/jobs with idempotency keys, batch/scheduled jobs, retry/reprint, webhooks, and audit-grade raw-payload capture. See the developer docs →
Visual workflow engine (cloud + on-prem edge) with a customizable operator Print Dialog as a human checkpoint before regulated output goes out. Explore workflows →
Read-only enterprise DB connectors — Oracle, SQL Server, PostgreSQL, MySQL/MariaDB via an on-prem sidecar; credentials never leave the machine, with a hash-chained query audit. (Windows.)
Native printer-language output — ZPL, TSPL/TSPL2, Toshiba TPCL, and Epson ESC/Label — driverless raw USB, TCP/IP, or Bluetooth, with bidirectional status readback.
MCP + AI design assistant for authoring, while every physical print still flows through the same immutable, signed history.
ANY PRINTER
Design it, bind your data, print on the printer you already own.
Zebra, TSC, Toshiba, Epson and more — over USB, network or Bluetooth, with no driver to install.
PRICING
Start free. Pay when it earns its keep.
QUESTIONS / FAQ
Frequently Asked Questions
Is LabelInn certified for 21 CFR Part 11?
No software is "certified" for 21 CFR Part 11 — compliance is a property of your validated process, not a vendor checkbox. LabelInn provides the technical controls a Part 11 / EU Annex 11 style program needs: immutable hash-chained print history, a self-verifying audit log, re-authenticated electronic signatures, and RBAC. You validate the process; LabelInn supplies the enforced records and controls to support it.
What makes the audit log tamper-evident?
Every print-history entry is chained to the previous one with a SHA-256 hash and signed with a per-company HMAC key. Altering, deleting, or reordering any entry breaks the chain and fails verification. The log is self-verifying — you can re-run the chain at any time to prove it hasn't changed.
Does label approval support electronic signatures?
Yes. Approval can require an electronic signature that forces a fresh re-authentication at the moment of signing, so the signature is bound to that specific person and action — FDA 21 CFR Part 11 / EU Annex 11 style.
Can I prove exactly what was printed on a past label?
Yes. LabelInn captures the design saved-vs-printed state per element and stores the raw print payload, so you can reconstruct any historical label's provenance — the design and revision, the data values, who initiated and approved it, and the exact bytes sent to the printer.
Which plan includes compliance mode, e-signatures and audit logs?
Enterprise. Compliance mode (e-signatures, Part 11 style controls, GHS presets), audit logs and the design and print approval queue are Enterprise features, quoted per deployment. The 14-day trial includes them. Print history is on every plan: 30 days visible on Free and the full archive from Starter.
What does one audit record contain?
The actor (user, API key, rule, system or edge device), the action (print, cancel, reprint, verify, config_change and others), the resource it concerns, details and a payload hash, a sequence number, the previous record's hash, its own SHA-256 content hash and an HMAC-SHA256 signature with a key id.
How do I audit every change to a label and who reviewed it?
Changes to designs, rules and configuration are recorded as config_change events with the actor and the resource. Prints and reprints are recorded with the per-element values that were printed, and approvals use an e-signature that requires re-authentication. The chain can be queried and verified through the audit API.
What does the hash chain not prove?
That a record was not altered after it was written, not that the data was correct when it was entered, and not that your process is validated. Validation of the process stays with you.
KEEP GOING
Related
NEXT STEP / LABELINN
Audit-Ready Label Printing
Built for chemical, food, and pharma teams who need to prove what they printed — not just claim it. Start the free trial and run a real approval on your own labels. · Immutable, hash-chained print history · Re-authenticated e-signature approval · Part 11 / Annex 11 style controls on Enterprise