Most services contracts are written so that the vendor controls the record of what happened. We refuse to engage on those terms. This is the clause that replaces them, in plain English, and why it is the first thing we negotiate.
The clause, in the language we actually sign
Every SWU engagement carries some version of this paragraph in the master agreement. Names and section numbers vary; the substance does not.
Shared-Ledger Access. During the term of this engagement and for no less than seven (7) years after its termination, the Client and the Provider shall each have continuous, unrestricted read access to the append-only engagement ledger maintained for this engagement. Neither party may alter, redact, delete, or relocate prior entries; corrections are made by new, signed entries that reference the entry being corrected. On termination, the Provider shall furnish the Client with a complete copy of the ledger in a non-proprietary, machine-readable format. The Client's read rights survive termination, assignment, sale, and dissolution of the Provider.
That is the whole thing. It is short on purpose. A clause that needs a glossary will be argued about; a clause that fits in one paragraph will be signed.
What it forces on us (the vendor)
This is the part vendors usually do not advertise, so we will name it directly. The clause is not a marketing prop. It binds us in four concrete ways (Class C — these are properties of the engagement configuration itself, not aspirations):
- We cannot edit history. Once an entry lands — a scope, a decision, an approval, a deliverable hash — it is there. We cannot quietly fix an embarrassing line by rewriting it.
- We cannot withhold the record on exit. A copy in a machine-readable format ships with the closeout. Not a PDF screenshot of selected entries. The file.
- We cannot outlive your access. If SWU is acquired, restructured, or wound down, your read rights follow the ledger, not us.
- We cannot run a second, secret version. The shared ledger is the ledger. There is no internal copy with extra entries the client never sees.
These constraints are not free for us. They foreclose several business models that other consultancies rely on — selectively forgetting old commitments, controlling the post-mortem narrative, charging for "ledger reconstruction" later. We took those off the table on purpose.
What it forces on you (the buyer)
The clause is symmetric. It binds the client too, and the binding is the part that makes it work (Class C):
- You cannot retroactively deny an approval you signed. Your approval is a ledger entry with a timestamp and a signature. It does not move.
- You cannot ask us to delete an entry you later wish had not happened. A decision to abandon a vendor, kill a feature, or change direction is part of the record. We will add a correcting entry if the facts change; we will not erase the old one.
- You are accountable to your own future auditor. If you change roles or your organization changes hands, the next person in your seat inherits the same file you did. That is a feature, not a bug.
A clause that only protected one side would be a marketing exercise. The reason this one holds is that both sides give up something most contracts let them keep: the ability to quietly own the story.
Why this clause is the gate
We do not start engagements without it. There are two reasons, and they are not negotiable.
First, every other transparency commitment we make — falsifiers on claims, evidence-classed receipts, exit-ready artifacts — runs through the ledger. If the ledger is not shared and append-only, those commitments are theater. The clause is the load-bearing wall; the rest of the house rests on it (Class C).
Second, append-only audit access is not exotic engineering. It is how regulated finance reconciles, how serious security teams keep forensic trust during an incident, and how every version-control system you have ever used works under the hood (Class E — immutable / append-only audit logs are a standard control in security, finance, and forensic engineering literature). Asking for it in a services contract is asking a vendor to bring industry-standard discipline to the soft parts of the relationship. A vendor who pushes back on this clause is telling you, in advance, that they want room you should not give them.
A practical note on negotiation
Counsel on the other side will occasionally ask whether the seven-year tail can be shortened, whether "non-proprietary format" can be defined as "PDF," or whether the survival clause can be carved out on acquisition. The answers are no, no, and no — and the reason is the same in all three cases. Each modification re-opens exactly the failure mode the clause exists to close. If we negotiated any of them away, we would no longer be selling what we say we are selling.
If a buyer's counsel reads this clause and asks no questions at all, that is also a signal — usually that the buyer has been burned before and recognizes the shape of the protection.
The surrounding pieces are here:
- Partnership vs Vendor Contract — the larger contract posture this clause lives inside.
- The Ledger Is The Single Source Of Truth — what the ledger itself looks like in practice.
- Book a workshop — the first ledger entry on your engagement opens it. We will walk through this clause line by line before either side signs.