From a237f045b246d421675d3610d7c8e7712153f1d3 Mon Sep 17 00:00:00 2001
From: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:44:43 -0700
Subject: [PATCH] fix(copy): qualify hashing claims on trace,
 supplier-compliance, export

---
 frontend/src/app/supplier-compliance/page.tsx | 2 +-
 frontend/src/app/tools/export/page.tsx        | 4 ++--
 frontend/src/app/trace/page.tsx               | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/src/app/supplier-compliance/page.tsx b/frontend/src/app/supplier-compliance/page.tsx
index 540694b05..de13d7435 100644
--- a/frontend/src/app/supplier-compliance/page.tsx
+++ b/frontend/src/app/supplier-compliance/page.tsx
@@ -70,7 +70,7 @@ const FAQ = [
     },
     {
         q: 'Is my data secure?',
-        a: 'Yes. Every submission is SHA-256 hashed and cryptographically chain-linked. Data is stored in tenant-isolated databases with row-level security. Your data is only visible to you and the buyer who generated your portal link.',
+        a: 'Submissions are SHA-256 hashed and cryptographically chain-linked where enabled. Hashing is a RegEngine feature, not an FDA requirement. Data is stored in tenant-isolated databases with row-level security. Your data is only visible to you and the buyer who generated your portal link.',
     },
     {
         q: 'What does this cost me?',
diff --git a/frontend/src/app/tools/export/page.tsx b/frontend/src/app/tools/export/page.tsx
index 75652d9f1..fb16551dd 100644
--- a/frontend/src/app/tools/export/page.tsx
+++ b/frontend/src/app/tools/export/page.tsx
@@ -46,12 +46,12 @@ const PACKAGE_PARTS = [
   {
     icon: Shield,
     title: 'Chain Verification',
-    body: 'SHA-256 hash chain proving record integrity. Each event cryptographically linked to its predecessor.',
+    body: 'SHA-256 hash chains support tamper detection where enabled. Hashing is a RegEngine feature, not an FDA requirement.',
   },
   {
     icon: FileCheck,
     title: 'Package Manifest',
-    body: 'Cryptographic manifest with file checksums. Independent verification without RegEngine.',
+    body: 'Manifest with file checksums for checking content hashes where enabled.',
   },
 ];
 
diff --git a/frontend/src/app/trace/page.tsx b/frontend/src/app/trace/page.tsx
index 2a56bb607..e744cd05c 100644
--- a/frontend/src/app/trace/page.tsx
+++ b/frontend/src/app/trace/page.tsx
@@ -340,7 +340,7 @@ export default function TracePage() {
                 <div className="min-w-0">
                   <CardTitle>CTE Event Timeline</CardTitle>
                   <CardDescription className="mt-1">
-                    Each event is cryptographically hashed (SHA-256) for tamper-evident traceability
+                    Events are SHA-256 hashed where enabled. Hashing is a RegEngine feature, not an FDA requirement.
                   </CardDescription>
                 </div>
               </CardHeader>