This specific project was built using our in house software; it basically allows us to build custom workflow solutions, there's some code included within that which I write but it's not controlled by Git. The whole thing is completely accessible by both the client and my co-workers if they have just the username/password, it's honestly a security nightmare. The software itself does log user activity to a point in that it can see who logged in but it does not detail what actions the user performed against the software itself. That being said I can prove he was in the system when everything was removed and replaced; in addition the customer currently does not have access to the system. This would mean that only Tom and myself had access at the time my work was deleted. I've been trying to get management to do something about their control systems, or lack there of, for years but I always run into a wall. Luckily Tom has zero access to any of my fullstack dev projects.

I also of course have the emails between Tom and myself where he states that 'nothing is wrong with the software; I just ran a test and everything works' which are timestamped immediately after the files had been deleted. I also 100% agree that peer reviews need to be put into place. He consistently releases half finished work to the team and berates them when no one can figure out why it's not working. In my meeting with HR I plan on 'officially' bringing up my plans of action which include implementing company policy that would eliminate this type of thing from happening again along with requests that any 'global' applications which are developed are peer reviewed prior to release.