Audkit
Terms

Terms of Service

Effective 10 September 2026

These terms govern your use of Audkit. By creating an account you agree to them.

The service

Audkit provides an append-only, tamper-evident audit log: an API that seals events into a per-project Merkle tree, proofs and verification endpoints, a dashboard, and an SDK. We may change or improve the service, but we will not remove the ability to export your data or verify it.

Your account

You are responsible for the security of your credentials and API keys. Keys are shown once and can be revoked at any time; treat a leaked key as capable of writing events in your name until you revoke it. Every member of an organisation can access that organisation's projects — model your access boundary at the organisation level.

Acceptable use

You agree not to:

  • send data you have no right to send, or that is unlawful;
  • use Audkit to build a record you intend to present as evidence of something that did not happen;
  • attempt to degrade the service for others, or circumvent rate limits and quotas;
  • resell the service as a substantially similar audit-log product.

Security research is welcome under the terms set out on the Security page.

What tamper-evidence does and does not mean

This section matters more than the rest, so it is stated plainly rather than buried. Audkit makes unauthorised modification of a stored record detectable. It does not make it impossible.

  • We guarantee that events are sequenced and committed to the Merkle tree before the API responds, that the API offers no way to edit or delete an event, and that signed roots are published to a public transparency log we do not control.
  • We do not guarantee that the contents of an event are true. Audkit records what your application sends; it cannot know whether that is accurate.
  • A party with direct database access can alter stored rows. What prevents this from being a silent rewrite is that it breaks the published roots. Verification is therefore something you should actually run — with the open-source audkit CLI, against roots you have kept — not something you assume.

Audkit is not legal advice and does not by itself make you compliant with any regulation. Whether your use satisfies a given obligation is yours to determine.

Billing

Paid plans are billed monthly in advance. Event overage is metered and billed per unit at the rate shown on the pricing page. You can cancel at any time, effective at the end of the current period; we do not refund partial months. If billing fails persistently we may suspend ingestion after notice — suspension stops new writes and never deletes sealed data.

Data and termination

Your data remains yours. Export is available on every plan, including the free one, and continues to work while your account is open. On termination you may export for 30 days, after which data is deleted in line with the Privacy Policy. Previously anchored tree roots remain in the public transparency log permanently and cannot be withdrawn; they contain no event content.

Availability and warranties

The service is provided "as is", without warranty of any kind. We do not currently offer a contractual uptime commitment; if you need one, contact us before relying on Audkit for a regulated workload.

Liability

To the extent permitted by law, our total liability arising from the service is limited to the amount you paid us in the twelve months before the claim. We are not liable for indirect or consequential loss, including lost profits or the cost of a regulatory finding. Nothing here limits liability that cannot lawfully be limited.

Changes and contact

We will announce material changes to account owners by email before they take effect. Questions: legal@audkit.dev.