An audit log you can prove — and still query.
An append-only, hash-chained audit trail where any change breaks the chain and the exact tampered entry is named. It's verifiable by anyone without going through us, and it stays compressed and queryable — so you don't have to lock your evidence inside one database or bolt on a blockchain to make it stick.
Append-only, hash-chained
Every entry commits to the one before it. The log grows forward and can never be quietly rewritten — a change anywhere breaks the chain from that point on.
Pinpoints the tamper
Verification doesn't just say pass/fail — it identifies the exact entry that was altered, inserted or removed. You get the where, not just the whether.
Verifiable without us
The proof is in the file, not our servers. An auditor, regulator or counterparty can verify integrity independently — no vendor account, no lock-in.
Compressed and queryable
It's still an AT-1 archive: the log stays small and you can query it in place, so integrity doesn't cost you searchability or storage.
Where it sits
| Approach | Tamper- evident | Independently verifiable | Portable / no lock-in |
|---|---|---|---|
Plain application logs easy to write, trivial to alter — no integrity guarantee at all | |||
Database-native ledger (e.g. SQL Server Ledger) strong, but locked to that database and verified through the same vendor | |||
Blockchain / DLT independent, but heavy, slow and expensive for what is really an append-only log | |||
AT-1 audit log hash-chained, vendor-independent, portable, compressed and queryable |
One command surface
at1 ledger append events.jsonl --out ledger/ # append entries, hash-chained at1 ledger verify ledger/ # -> integrity: PASS (or names the broken entry) at1 ledger query ledger/ --where actor:alice # query the log in place, still compressed at1 ledger prove ledger/ 4821 # emit a portable proof for one entry
Prior art (Certificate Transparency, QLDB, database ledgers) makes hash-chained logging a known technique — so this ships as a public capability, not a patent claim. Our contribution is the portable, compressed, queryable, tamper-pinpointing package.
Audit-log questions, answered
- What makes an audit log tamper-evident?
- Each entry cryptographically commits to the previous one (a hash chain), so altering, inserting or deleting any entry changes every hash after it. Verification recomputes the chain and fails if a single byte moved — and AT-1 reports the exact entry where the break occurs.
- How is this different from SQL Server 2022 Ledger or a database's built-in audit table?
- Database-native ledgers are strong but tie your proof to that database and vendor — you verify through the same system you're trying to hold accountable. AT-1's log is a portable, self-contained artifact: the integrity proof travels with the file and anyone can verify it independently, no vendor account required.
- Do I need a blockchain for an immutable audit trail?
- No. A blockchain is a distributed-consensus system solving a much harder problem than an internal audit log. A hash-chained append-only log gives you the same tamper-evidence and independent verification without the throughput, cost and operational overhead of a distributed ledger.
- Can I still search the audit log, or does immutability make it opaque?
- You can query it in place. The log is an AT-1 archive, so it stays compressed and supports predicate/projection queries — you get integrity and searchability in the same artifact, instead of trading one for the other.
Have an audit trail that has to hold up under scrutiny? Let's prove it does.
Get in touch