Social media evidence for HR investigations: Online evidence you can check, not just assert.
Keep the hearing about the conduct, not about whether the screenshot was doctored. Harassment, leaks and online conduct increasingly sit at the centre of workplace investigations; Shorenet records what the platform delivered when your investigator looked, sealed, so the other side’s representative can check it.
Exhibit 04 · sealed
Public post, shared outside the company
@a.employee.example
Here is the slide they did not want you to see.
- Captured 16 February 2026, 12:09 UTC
- SHA-256
7cd83142…0a293b97 - Timestamped by DigiCert (RFC 3161)
- Witnessed by the Shorenet relay
Verified · independently witnessed
Screenshots are the weakest part of the file
A screenshot of a post or a message is trivial to fake, and increasingly people know it. When it is the key evidence in a disciplinary or grievance case, a challenge to it can unpick the whole process, and the post has often been deleted by then. Screenshots as evidence: see how easy the fake is.
A Shorenet capture preserves the post as it was served. It is witnessed in transit by our relay, which is independent of whoever captured it, and then sealed, so the other side’s representative or expert can check it rather than argue over it.
Where it fits
- Harassment and bullying. Public posts and comments directed at colleagues.
- Leaks and confidentiality. Confidential information that appears on a public site or forum.
- Conduct and reputation. Public online conduct relevant to a disciplinary case.
- Evidence you were given. When a complainant supplies a link, capturing it properly before it is taken down.
How to preserve social media evidence before a post is deleted.
What it does not do
- It is not a monitoring tool. It records what the capture browser receives when your investigator looks. While capturing, all of that computer’s traffic passes through our relay, but only the capture browser’s traffic is decrypted. Your lawful basis and privacy obligations are unchanged.
- It does not identify who ran an account. It proves what the site showed the account as publishing, not who was operating it.
- It cannot capture what has already been deleted. Capture as soon as the evidence is reported.
- We operate the relay. It is independent of your investigator, not of us. What trusting our relay means.
Get it right the first time.
We are inviting HR, employee relations and investigations teams to evaluate it before general release, on the cases they actually handle.