Audkit

chain intact — head #184,217

Proof, not
promises.

Audkit is the append-only record of everything your product does. Every event is sequenced, hash-linked to the one before it, and signed — so the entire history can be re-verified on demand, down to the first record.

Start the recordnpm i audkit

live record — acme-prodappend-only · no update · no delete

#184,182a16d → dbce

#184,183dbce → 2d3f

#184,1842d3f → b8be

#184,185b8be → a910

#184,186a910 → b3fd

#184,187b3fd → 0057

#184,1880057 → 258d

#184,189258d → cf9b

#184,190cf9b → 88b4

#184,19188b4 → ddf8

#184,192ddf8 → caed

#184,193caed → 04f1

#184,19404f1 → 274f

#184,195274f → 551e

#184,196551e → 2c8f

#184,1972c8f → 38aa

#184,19838aa → 6c71

#184,1996c71 → 080a

#184,200080a → bf0e

#184,201bf0e → afde

#184,202afde → ee12

#184,203ee12 → 37cb

#184,20437cb → 95e7

#184,20595e7 → ca83

#184,206ca83 → 4f44

#184,2074f44 → 2827

#184,2082827 → ff5f

#184,209ff5f → 39d6

#184,21039d6 → 717c

#184,211717c → d8c2

#184,212d8c2 → 257d

#184,213257d → 5084

#184,2145084 → 784a

#184,215784a → 840d

#184,216840d → 23f2

#184,21723f2 → fc52

#184,182a16d → dbce

#184,183dbce → 2d3f

#184,1842d3f → b8be

#184,185b8be → a910

#184,186a910 → b3fd

#184,187b3fd → 0057

#184,1880057 → 258d

#184,189258d → cf9b

#184,190cf9b → 88b4

#184,19188b4 → ddf8

#184,192ddf8 → caed

#184,193caed → 04f1

#184,19404f1 → 274f

#184,195274f → 551e

#184,196551e → 2c8f

#184,1972c8f → 38aa

#184,19838aa → 6c71

#184,1996c71 → 080a

#184,200080a → bf0e

#184,201bf0e → afde

#184,202afde → ee12

#184,203ee12 → 37cb

#184,20437cb → 95e7

#184,20595e7 → ca83

#184,206ca83 → 4f44

#184,2074f44 → 2827

#184,2082827 → ff5f

#184,209ff5f → 39d6

#184,21039d6 → 717c

#184,211717c → d8c2

#184,212d8c2 → 257d

#184,213257d → 5084

#184,2145084 → 784a

#184,215784a → 840d

#184,216840d → 23f2

#184,21723f2 → fc52

mutation endpoints — the API cannot edit or delete

SHA-256

links every event to the one before it

Ed25519

customer-held keys sign events before they leave your infra

1 receipt

signed verdict for every verify()

01 — seal

prev 00000000

An event becomes permanent in six steps.

01queued

One FIFO lane per project. Order is enforced by the queue, not hoped for.

02sequenced

A monotonic counter assigns the event its place. The next number is never in doubt.

03linked

prevHash — SHA-256 of the previous event — welds it to the record so far.

04signed

HMAC-SHA256 over sequence, timestamp, and both hashes. The seal.

05mirrored

Safe aggregates flow to analytics. Payloads never leave Postgres.

06broadcast

The dashboard sees the event the moment it lands.

the sealed fields

sequence018442gaps and reorderings have nowhere to hide

createdAt…T09:16:11Zserver-assigned; folded into the signature so time cannot drift

prevHasha8d772…altering any event breaks every link after it

payloadHash5e2b88…a fingerprint built to outlive the payload itself

signature9f3b…21forging a field means forging the key

02 — verify

prev 9759cdf8

Don't trust it. Check it.

There is no edit endpoint to abuse — forging history means writing to the database directly. Even that shows: the altered row no longer matches the hash sealed into its successor. verify() re-walks the chain from sequence 1 and returns a signed receipt. When something is wrong, it names the exact sequence.

const receipt = await audit.verify();

receipt.valid;        // false — someone touched row 88,412
receipt.checkedCount; // 184,201 events re-walked, from sequence 1
receipt.firstBreak;   // { sequence: 88412, reason: "hash_mismatch" }
receipt.signature;    // the receipt itself is signed. check it.

what a forgery looks like

#88,4095ad4…1e5dseal verified

#88,41073ca…62e2seal verified

#88,411247e…a620seal verified

#88,41212b0…5d5fhash_mismatch — row edited in place

#88,413e391…33ebunverifiable — downstream of the break

#88,414cc1d…a3a2unverifiable — downstream of the break

firstBreak

Not just “something is wrong” — the exact sequence where the chain no longer holds.

signed receipts

Every verdict is signed by the platform. The proof of integrity can't be forged either.

customer-held signing

Bring your own Ed25519 key. The SDK signs each event before it leaves your infrastructure, and only you hold the private key — a history not even the platform can forge.

out-of-band anchors

Email digests carry the signed chain head. Truncate the record and the last anchor disagrees.

a second stream

The platform's own control-plane actions land in project-audit — and verify the same way.

03 — ship

prev 37549f8e

First event in five minutes.

01create a project
Personal or org-owned. The chain starts at sequence 1.
02mint a scoped key
log:write · log:read · log:export · log:verify. Shown once, revocable always.
03send the first event
One call. A 202 comes back before the seal work starts — your request path never waits.

import { Audkit } from "audkit";

const audit = new Audkit({ apiKey: process.env.AUDKIT_API_KEY! });

await audit.log({
  action: "role.changed",
  actor: { type: "user", id: "usr_9f27", display: "dana@acme.dev" },
  target: { type: "member", id: "mem_512", display: "kai@acme.dev" },
  metadata: { from: "member", to: "admin" },
});
// 202 — accepted. sequenced, linked, signed. permanent.

04 — govern

prev 5f7de154

Compliance without holes in your history.

Hard-delete retention

When events pass your retention window — 90 days by default, or never — Audkit deletes the payloads outright and the storage actually shrinks. Sequence, hashes, and signatures stay in the chain, so every old record still verifies end to end. Minimize data. Keep proof.

shred_expired_event_payloads()

Legal holds

Build a hold from a query — actor, action, time range. Matching events are committed to a Merkle root anchored into the platform's own audit chain, with inclusion proofs on demand. Deletion is blocked for as long as the hold stands.

merkle root · inclusion proofs

Agents on the record

AI tools act in production now. auditedTool() wraps any AI-SDK tool with risk labels, required reasons, and an authorize gate — every call enters the record as pending, then success, denied, or failed.

audkit/ai

const refund = auditedTool({
  client: audit,
  name: "refund_payment",
  risk: "high",
  requireReason: true,
  authorize: ({ input }) => input.amountCents <= 50_00,
  handler: ({ paymentId }) => payments.refund(paymentId),
});

05 — index

prev ef154ce6

The rest of the instrument.

Logs explorerSearch by actor, action, target, status — chain proof on every event.

Entity timelinesEverything an actor did. Everything done to a target.

Live activityEvents reach the dashboard the moment they seal.

AnalyticsVolume and breakdowns from a safe mirror. Aggregates only.

ExportsCSV or NDJSON — from the dashboard or an API key.

Route auditingwithAuditLogging() wraps a Next.js handler end to end.

Notification rulesA visual rule builder routing to email, webhook, Slack, Discord.

Email digestsDaily to monthly summaries, each carrying the signed chain head.

#184,182a16d → dbce

#184,183dbce → 2d3f

#184,1842d3f → b8be

#184,185b8be → a910

#184,186a910 → b3fd

#184,187b3fd → 0057

#184,1880057 → 258d

#184,189258d → cf9b

#184,190cf9b → 88b4

#184,19188b4 → ddf8

#184,192ddf8 → caed

#184,193caed → 04f1

#184,19404f1 → 274f

#184,195274f → 551e

#184,196551e → 2c8f

#184,1972c8f → 38aa

#184,19838aa → 6c71

#184,1996c71 → 080a

#184,200080a → bf0e

#184,201bf0e → afde

#184,202afde → ee12

#184,203ee12 → 37cb

#184,20437cb → 95e7

#184,20595e7 → ca83

#184,206ca83 → 4f44

#184,2074f44 → 2827

#184,2082827 → ff5f

#184,209ff5f → 39d6

#184,21039d6 → 717c

#184,211717c → d8c2

#184,212d8c2 → 257d

#184,213257d → 5084

#184,2145084 → 784a

#184,215784a → 840d

#184,216840d → 23f2

#184,21723f2 → fc52

#184,182a16d → dbce

#184,183dbce → 2d3f

#184,1842d3f → b8be

#184,185b8be → a910

#184,186a910 → b3fd

#184,187b3fd → 0057

#184,1880057 → 258d

#184,189258d → cf9b

#184,190cf9b → 88b4

#184,19188b4 → ddf8

#184,192ddf8 → caed

#184,193caed → 04f1

#184,19404f1 → 274f

#184,195274f → 551e

#184,196551e → 2c8f

#184,1972c8f → 38aa

#184,19838aa → 6c71

#184,1996c71 → 080a

#184,200080a → bf0e

#184,201bf0e → afde

#184,202afde → ee12

#184,203ee12 → 37cb

#184,20437cb → 95e7

#184,20595e7 → ca83

#184,206ca83 → 4f44

#184,2074f44 → 2827

#184,2082827 → ff5f

#184,209ff5f → 39d6

#184,21039d6 → 717c

#184,211717c → d8c2

#184,212d8c2 → 257d

#184,213257d → 5084

#184,2145084 → 784a

#184,215784a → 840d

#184,216840d → 23f2

#184,21723f2 → fc52

end of record — you've reached the head

Start the record.

Create a project, mint a key, send an event. What lands in the chain, stays in the chain.

Get started free Sign in

#000001 · prev 00000000 · reserved for your first event

Proof, notpromises.

An event becomes permanent in six steps.

Don't trust it. Check it.

First event in five minutes.

Compliance without holes in your history.

Hard-delete retention

Legal holds

Agents on the record

The rest of the instrument.

Start the record.

Proof, not
promises.