Humanitarian organisations keep their data and their results. Almost none keep the decision itself: the figures available on that day, the reasoning followed, the person who decided, the date. Two years later the answer depends on somebody's memory. The decision ledger fills exactly that gap, in an open format anyone can read and verify without SAVIA.
Every week saved in SAVIA produces one dated record. It is written once and never edited. A correction never replaces an existing record: it adds a new one that refers back to it.
| Field | Content |
|---|---|
| spec | Format identifier, here savia-decision-record/v1. |
| rang | Position in the ledger, starting at 1. |
| identifiant | Human readable reference, for example SDR-20260829-0007. |
| precedent | Fingerprint of the previous record, or the string "origine" for the first one. |
| emis_le | ISO 8601 timestamp in universal time, plus the local time zone. |
| type | decision_hebdomadaire (weekly decision) or resultat_constate (observed outcome). |
| programme | Name, profile, location and period concerned. |
| auteur | Who took the decision, with their role. |
| mesures | The figures actually available on that day. |
| bareme | Scoring version, weights and thresholds applied at that moment. |
| score | Value out of 100 and the corresponding verdict. |
| risques_documentes | Risks scored and, for critical ones, their written justification. |
| decision | The decision, written by the person who took it. |
| actions | Actions triggered, owners, deadlines. |
| resultat | What was actually observed afterwards, added later through a dedicated record. |
| empreinte | SHA-256 of the record, every field except this one. |
An organisation may change its weights or thresholds over time. Without a memory of the rule, an old score becomes unreadable. By keeping the rule applied on that day, the record stays interpretable fifteen years later.
Each record carries a SHA-256 fingerprint computed over its own content, and contains the fingerprint of the previous record. The records therefore form a chain.
Changing a figure in a past decision changes its fingerprint, and verification flags it immediately. Recomputing the fingerprint to hide the change is not enough: the next record still holds the old value, and the chain breaks at that point. Deleting a record from the middle breaks the chain as well.
In other words, rewriting history cleanly means rebuilding every later record. On a ledger already exported and handed to a funder, that is impossible without the funder's copy ceasing to match.
The fingerprint is computed locally, with no network and no third party service. A record can therefore be created and signed offline, on a field phone, and synchronised later.
Here is a real record in its exported form. The values are fictional, the structure is not.
{
"spec": "savia-decision-record/v1",
"rang": 7,
"identifiant": "SDR-20260829-0007",
"precedent": "9f4c2ae1d7b03e58c1a6f0d9b2e74c8153ab6d0f27e9c41a8b3d5e6f0a1c2b3d4",
"emis_le": "2026-08-29T14:51:10.482Z",
"fuseau": "Africa/Niamey",
"type": "decision_hebdomadaire",
"organisation": "Organisation name",
"programme": {
"nom": "Nutrition support Diffa",
"profil": "nutrition",
"lieu": "Diffa, Niger",
"periode": "W35 2026"
},
"auteur": {
"nom": "Programme manager",
"role": "manager",
"identifiant": "first.last@organisation.org"
},
"mesures": {
"kpi_pct": 70,
"risques_critiques": 2,
"actions_urgentes": 4
},
"bareme": {
"version": "3-1-1/v1",
"poids": { "kpi": 40, "risques": 30, "actions": 30 },
"seuils": { "stable": 80, "pression": 50 }
},
"score": { "valeur": 78, "sur": 100, "verdict": "UNDER PRESSURE" },
"indice_risque": 2.4,
"risques_documentes": [
{ "id": "acces", "intitule": "Humanitarian access", "note": 4,
"justification": "Bosso road closed since 24 August, two sites not reached." }
],
"decision": "Stay the course. Step up weekly monitoring in the two districts under strain.",
"actions": [
{ "intitule": "Reopen the supply corridor",
"responsable": "Field coordination",
"echeance": "2026-09-06", "statut": "open" }
],
"concerne": null,
"resultat": null,
"application": "SAVIA V8.5",
"empreinte": "c81b7f0a5d2e39461fbc8a0d7e5342196c0ba8df41e729c3506d8fa1b47e0c92"
}
Verification requires no tool from us. It takes five steps and rewrites in a few lines in any language.
// 1. remove the "empreinte" field from the object // 2. serialise to canonical JSON: keys sorted alphabetically at every level, // no whitespace, no line breaks // 3. compute SHA-256 of that string, UTF-8 encoded, lowercase hexadecimal output // 4. compare with the "empreinte" field: any difference means the record was altered // 5. check that "precedent" equals the fingerprint of record n-1 // (or the string "origine" for record 1) import json, hashlib def canonical(v): return json.dumps(v, sort_keys=True, separators=(",", ":"), ensure_ascii=False) def verify(ledger): expected = "origine" for e in ledger: body = {k: v for k, v in e.items() if k != "empreinte"} calc = hashlib.sha256(canonical(body).encode("utf-8")).hexdigest() if calc != e["empreinte"]: return "content altered at record %s" % e["rang"] if e["precedent"] != expected: return "chain broken at record %s" % e["rang"] expected = e["empreinte"] return "ledger intact"
A funder, an auditor or a researcher can therefore check a ledger handed to them, without asking our permission and without trusting us.
An honest format states its limits. These are real and we do not talk our way around them.
The ledger attests that a decision was taken on the basis of specific figures, on a specific date, by a specific person. It does not attest that those figures reflected reality on the ground. It is a guarantee of traceability, not of truth.
The fingerprint protects against silent alteration. It does not constitute a qualified signature under eIDAS or an equivalent national law, and we do not present it as one.
The date comes from the machine that creates the record. Anchoring to an independent time source is planned for a later version of the format. Until it exists, we do not claim otherwise.
Chaining guarantees the internal consistency of one ledger. It does not link the ledgers of two different organisations to each other.
The specification is public and free to use. Any organisation, any software vendor, any research group may produce, read or verify records in this format, with no licence to request and no dependency on SAVIA.
We want it that way. A ledger format is only worth something if it is shared, and no organisation should ever have to choose between keeping a record of its decisions and staying free to change tools.
Comments, corrections and extension proposals are welcome at contact@savia-humanitarian.org. Future versions will remain readable against v1.
Open SAVIA, enter one week, save it. The first record appears in the Ledger tab with its fingerprint, and you can export it straight away.
Open the application