For our web application we are maintaining some data, pertaining to our subscribers, on our server. Some of this data is sensitive and we would like to implement some "security measures" for this data. One is encryption, and we know how to do that. The other is non-repudiation of the content, and we don't know how to implement that.
Specifically we would like to handle the following use case. On day X customer stores some data on our server. On day Y they claim that the data was not stored by them (and implying that someone else stored the data). How can we guard against that kind of repudiation challenge from a customer?
Can we use some kind of hash or something? Keep in mind that customers may occasionally forget their passwords, and passwords may have to be regenerated upon customer request.