Audit Trail

A record that shows when it has been altered

Capture events — prompts, responses, diffs, rollbacks and redactions — are written append-only and chained together. Each entry carries the hash of the one before it, so altering or removing a single event breaks the chain at a knowable point rather than quietly rewriting history.

Book a demo

Append-only by design

Events are added, never edited in place.

Verification you can run in CI

One command walks the chain and returns an exit code.

Signed export

Dated, signed JSONL for handing to a third party.

Why a chain, and not just a log

A log is only as trustworthy as the person who can edit it. Chaining each event to its predecessor means an alteration cannot stay hidden: the record either verifies end to end, or it names the point where it stopped.

Book a demo

Each event carries the hash of the last

An event's hash is computed over its canonical contents together with the previous hash. The chain starts from a genesis record, so there is no valid history that does not begin at a known point.

Prompts, responses and diffs
Rollbacks and redactions
Tool, model, project and file path
UTC timestamp and machine identity

Deletion leaves a mark

In audit mode nothing is removed outright. A deletion is itself an event — a tombstone — so the fact that something was removed, and when, survives the removal.

Soft delete with a tombstone event
Original hash retained
Reason recorded where given

Verification returns an exit code

Chain verification is a command, not a dashboard reading. It walks every link, reports the first break and exits non-zero, which means a pipeline can fail on a broken record without anybody watching.

What each event records

Time and machine

A UTC timestamp and the machine or user identity the event came from.

Tool and model

The agent that ran and, where the transcript exposes it, the model and version behind the answer.

Project and file

The repository, the file path and the number of lines added and removed.

Redaction state

Whether secret-stripping applied to the event, so a gap in the text is explainable.

Canonical form

Events are hashed over a canonical encoding, so formatting differences cannot change a hash.

Genesis record

Every chain begins with a genesis entry, which makes a truncated history detectable.

What this is not

A chained record proves that what was captured has not been altered since. It does not prove that everything which happened was captured — an agent running on a machine with no recorder leaves no trace. That is a coverage question, and the reports treat it as one: unmonitored repositories are listed as unmonitored rather than counted as clean.

From the people already running it

The rollback points alone are worth it. Claude rewrote half my state layer at 2am — I restored the pre-refactor snapshot with one click.

Jonas Weber
Indie hacker

We run it self-hosted for the whole team. Compliance asked how AI-generated code enters our repo — for the first time, we just showed them.

Priya Raman
Eng Manager, healthcare SaaS

I stopped keeping a prompts.txt file the day I installed it. Three weeks later I traced a subtle bug back to one Cursor prompt in about ten seconds.

Maya Okafor
Staff Engineer, fintech

The rollback points alone are worth it. Claude rewrote half my state layer at 2am — I restored the pre-refactor snapshot with one click.

Jonas Weber
Indie hacker

We run it self-hosted for the whole team. Compliance asked how AI-generated code enters our repo — for the first time, we just showed them.

Priya Raman
Eng Manager, healthcare SaaS

Questions auditors ask

Can somebody with database access change the record?

They can change the bytes — no local file can prevent that. What they cannot do is change them without verification noticing. The chain is checked from the genesis record forward, so an altered or removed event breaks every link after it and the verification names where it stopped.

Does this replace our existing audit logging?

No. It covers a gap most logging does not reach: what an AI agent did inside a working copy, before anything was committed. It sits alongside your SIEM and your git history rather than replacing either.

What happens to secrets that appear in a prompt?

API keys, tokens and credentials are detected and dropped before anything is written. They are not redacted afterwards — they are never stored, so the record cannot leak what it never held. The event notes that redaction applied.

Can we export the record for a third party?

Yes, as dated JSONL. A signed export is on the roadmap so that a recipient can verify authorship without trusting the sender's copy.

See a chain break on purpose.

The quickest way to judge a tamper-evident record is to tamper with it. We will alter an event in a demo database and run verification in front of you.

Book a demo Code provenance

Governance

All product