A transparency log for signed stay offers: tamper-evident trust history

AI booking needs trust, and a host's trust history is part of that trust. But a trust history is only worth something if it cannot be quietly rewritten after the fact — and keeping it honest usually invites a gatekeeper: a central certification company that holds the record, decides who is in good standing, and becomes the very middleman independent hosts were trying to avoid.

There is another way. HemmaBo has shipped the VRP Transparency Log: an append-only, publicly auditable record of Vacation Rental Protocol artifacts that no one — not even HemmaBo — can rewrite without it being detectable, and that anyone can verify without trusting the operator.

What the transparency log is

The log is built on a Merkle tree following RFC 6962 — the same construction that secures Certificate Transparency, the public system that keeps the web's TLS certificates honest. Every entry is the hash of a signed VRP artifact: a signed stay offer, a portable attestation, or a status event. No cleartext and no guest data — just a fingerprint and the order it was recorded in.

From those entries the log publishes a signed tree head: a short, signed summary of the entire history at a point in time.

What it proves

• Inclusion. Anyone can ask the log for a proof that a specific artifact is recorded, then recompute the result themselves to confirm it — without taking HemmaBo's word for it.
• Append-only history. Anyone can ask for a consistency proof between two points in time and verify that the log only ever added entries and never rewrote or removed past ones.
• Independence. Both proofs are checked against the signed tree head using public keys. The verifier does not have to trust the server that produced them. If an operator tried to fork or rewrite history, the proofs would fail.

The whole point of HemmaBo and the Vacation Rental Protocol is that the host-owned domain is the source of truth, not a central authority. The transparency log is built to keep that promise:

• It is optional. A VRP signed stay offer or portable attestation still verifies standalone from the host's own domain — the domain's signature and keys are enough. Inclusion in any log is never a condition for a stay to be real or bookable.
• It is additive. Being in the log proves recording and append-only history only. It is never approval, certification, ranking, or a score. The log says "this existed and was not rewritten" — nothing more.
• It is multi-operator by design. HemmaBo runs a reference log, but the design expects many operators. No single log is the official one, and no operator becomes the keeper of the truth.

What HemmaBo refuses to become

This is the same line we have held from the start. A transparency log must not quietly turn into the gatekeeper it replaces. HemmaBo is not a trusted issuer registry, not a certification company, not a scorer, accreditation body, OTA, marketplace, merchant of record, or booking intermediary.

An independent host should never need permission from a central registry before their own domain can present — and now durably evidence — a verifiable direct booking offer.

What is live

The cryptographic core is implemented and tested: building the tree, producing inclusion and consistency proofs, and rejecting any forged or rewritten entry. The reference log runs on HemmaBo's platform, and the signed offers served by a live host node like villaakerlyckan.se are exactly the kind of artifact it records. Anyone can append an artifact hash, fetch the proof, and verify the signature and the Merkle math themselves.

The design is deliberately conservative: prove that history is append-only and independently checkable, without making HemmaBo the owner of that history.

The transparency log underpins host-owned direct booking: the host keeps the domain, the guest relationship, and the booking; the Vacation Rental Protocol signs the offer; and the log makes the trust history tamper-evident — with no certification company in the middle. The standard is VRP Transparency Log v0.1, published with the Vacation Rental Protocol.