The ledger.

Every ticket issued, vote cast, listing, trade, payout and gate scan. Each entry carries the SHA-256 fingerprint of the entry before it, and every fan action carries the holder's signature. The head fingerprint is written to the Base blockchain on a schedule, so nothing before an anchor can be rewritten, even by us.

Verify it yourself: fetch /api/ledger?after=0&limit=500, recompute sha256(prev_hash | at | kind | data | signer | sig) for each entry, and compare the head to the anchored value on-chain.