The Surprise Audit
An external auditor asks for proof of who accessed customer data over the last 12 months. The records exist. But no one can prove they were never altered.
“Logs describe events. They don't prove them.”
Observe · Detect · Audit · Prove Core built with Rust
Know what happened.Detect what matters.Prove what happened.
See what is happening across your critical events, detect what matters, reconstruct who did what, and prove it cryptographically under audit, dispute, or investigation.
SEALING · DEMO● CHAIN VALID
#48296refund_granted0xf5e8
#48295login_success0xf55f
#48294config_change0xf4d6
#48293admin_access0xf44d
#48292record_viewed0xf3c4
Append-only ledgerCryptographic inclusion proofIndependently verifiable
Full visibility into every critical event. Cryptographic proof when it counts.
ImmutableLog is the infrastructure layer that observes, detects, and cryptographically seals the events that matter, tamper-evident and independently verifiable, before anyone has to ask for proof.
- /01Real-time observability
- /02Threat detection
- /03Cryptographic proof of inclusion
When proof matters
01 / 03Three moments when proof changes everything
The Security Incident
A breach is discovered. The attacker had admin access for weeks. Investigators ask what happened, and whether the logs themselves were altered.
“Without tamper-evidence, your incident timeline is only a guess.”
The Legal Dispute
A customer claims their data was accessed without authorization. Your logs say otherwise. Their lawyers ask how those logs can be verified.
“Logs can be questioned. Cryptographic proof makes their integrity independently verifiable.”
One event, four layers
One event. Four layers of value.
The same event flows through observability, detection, audit, and cryptographic proof, no separate tools, no separate pipelines.
Observe
L/01Understand what is happening in your software.
- Logs & events
- Errors
- Services
- Environments
- HTTP status
- Endpoints
- Timeline
- Search & filters
Detect
L/02Identify suspicious or relevant behavior.
- Detection rules
- Brute force
- Suspicious IP
- New country
- Unusual admin/root activity
- 401/403 spikes
- Error spikes
- Threat intelligence
Audit
L/03Reconstruct who did what, when, where, and on which resource.
- Actor
- Action
- Resource
- Timestamp
- Source IP
- Service
- Request ID
- Audit timeline
- Export
Prove
L/04Cryptographically verify that the evidence remained intact.
- Event hash
- Block
- Merkle proof
- Proof of Inclusion
- Integrity verification
- Cryptographic evidence
Why now
Three forces making provable operations non-optional
Trust used to be assumed. Today it must be demonstrated to regulators, customers, courts, and increasingly, to AI oversight bodies.
AI governance is becoming law
EU AI Act, NIST AI RMF, ISO 42001, and emerging national frameworks share one demand: organizations must produce verifiable records of automated decisions and the data behind them.
Compliance now demands proof, not assertion
SOC 2, ISO 27001, LGPD, and sector-specific frameworks have shifted from "document your controls" to "prove they were applied." Self-reported logs are no longer sufficient evidence.
Insider risk and fraud are getting more sophisticated
Privileged users with the ability to alter their own audit trail remain the highest-impact threat. Independent, tamper-evident records provide stronger evidence for audits, investigations, arbitration, and legal disputes.
When logs were not enough
Recurring patterns where traditional logs failed under pressure
Each of these is a publicly observed pattern across enterprise incidents. None required a sophisticated attacker: only a system where the same people generating the logs could also alter them.
Pattern · Insider AccessP/01
The privileged employee with months of unmonitored access
An employee with admin credentials accesses millions of records over an extended period. The activity is technically logged, but the same role can edit, rotate, or rebuild those logs. By the time investigators arrive, the trail is partially gone.
With independent immutable records, the access pattern is preserved beyond the reach of the user being investigated.
Pattern · Audit ReconstructionP/02
The compliance team with 48 hours and five disconnected systems
An auditor requests a year of access events for a critical asset. Logs were rotated, partially purged, and split across infrastructure managed by different teams. Reconstruction takes weeks and produces partial answers, which regulators interpret unfavorably.
With a continuous evidence chain, audit responses become export operations, not forensic projects.
Pattern · Disputed TransactionP/03
The high-value transfer contested years after the fact
A customer disputes a transaction or configuration change executed long ago. The application logs are intact, but they live on the same systems the customer is questioning. There is no record they would consider neutral.
Cryptographic proof of inclusion strengthens the evidence used in arbitration, regulatory review, or court, verifiable by a third party.
These are not edge cases. They are the moments when the absence of cryptographic evidence becomes expensive.
Immutable audit + SIEM
It no longer just proves the log didn't change. Now it enriches and detects.
Every sealed event is normalized to ECS, geolocated by the real user's IP, cross-referenced with threat intelligence, and evaluated by detection rules, all without ever losing the immutability proof.
01
Real end-user IP
meta.client_ip becomes source.ip with maximum precedence, so geo, threat and detection run on the actual user, not the proxy.
02
Geolocation & threat intel
Country, city and coordinates for every event, cross-referenced with threat feeds to surface risky IPs.
03
Rule-based alerts
Brute-force, new-IP, threat hits and more: detections raised per tenant and linked back to the exact event.
The differentiator
source.ip is the end user, not the proxy
Between the browser and the core there are proxies and load balancers. Your backend forwards the browser's real IP in meta.client_ip, and the SIEM writes it to source.ip with provenance client_asserted.
Without client_ip
44.192.13.3
AWS proxyWith client_ip
179.110.4.205
real userThe core seals it. The SIEM reads and enriches it.
Browser
Client backend
Core: seals in the chain
SIEM: enrich + detect
Your panel
What we already detect today
Credential probing
Repeated failed logins from the same IP, the signature of a scan or a brute-force attempt.
Login followed by deletion
The same user logs in and deletes data right after, a pattern consistent with a compromised account.
New access point
A login from an IP never seen before for that tenant, flagged the first time it happens.
Root and admin activity
Every authenticated action by a root or admin user is tracked, since it should be rare and always reviewed.
Threat intelligence hits
Traffic touching an IP flagged by reputation feeds such as Spamhaus, Tor exits or known compromised hosts.
Unauthorized responses
Repeated 401 responses from the same IP, the pattern of a credential scan against the API.
Access denied attempts
Repeated 403 responses for the same user, an account reaching for what it isn't allowed to touch.
New country of origin
Traffic from a country never seen before for that tenant, an unusual shift in where requests come from.
Error spikes in production
An unusual surge of errors in the customer's production environment, on the same service, a signal an incident is under way.
The Audit Trail
Know who did what, and when.
Every sealed event carries the context to reconstruct it fully: who acted, what they did, on which resource, and where the trail continues. No reconstruction across five systems, no scrambling before an audit.
Filter by actor, service, environment, or time range, then export the trail for the auditor, the regulator, or your own investigation.
What every event reconstructs● SEALED
Actoradmin_01
Actiondelete_database
Target / resourcedb.customers
Timestamp2026-01-30T14:20:00Z
IP179.110.4.205
Servicebilling-api
Environmentproduction
Requestreq_8f21c4e0
Related events3 linked →
Engineering
Trace exactly what changed in production and who triggered it, without digging through five different systems.
Security
Reconstruct the full sequence around an incident: actor, action, and every related event in context.
Compliance
Answer "who did what, when" with an exportable, verifiable trail instead of a self-reported log.
Customer audits
Hand auditors a filtered export instead of a week of manual reconstruction.
The Evidence Layer
What is ImmutableLog
ImmutableLog is a security, audit, and event observability platform built on a private, permissioned cryptographic ledger. The SIEM helps you observe, enrich, detect, and investigate. The Core preserves the original evidence and makes its integrity cryptographically verifiable.
01
Private ledger: events remain within your environment. No public blockchain.
02
Append-only immutability: events cannot be edited or deleted once written.
03
Cryptographic proof: every event is verifiable through deterministic hashing.
04
Independent verification: anyone can recompute the inclusion proof, and consensus across multiple nodes means no single node can rewrite history on its own.
What ImmutableLog is not
ImmutableLog is not a public blockchain. It does not use cryptocurrency or tokens. It is infrastructure for proof: making your event history verifiable and auditable.
Config vs Cryptography
Immutable by configuration isn't immutable.
Retention locks, WORM and IAM policy are configuration, turned off by whoever holds admin. The question isn't "is it locked?", it's "locked against whom?".
Immutable by configuration
- WORM, retention lock, IAM policy
- Reverted by whoever controls the config (admin or vendor)
- No answer to "was this altered?"
- Circular trust: the platform validates itself
Immutable by cryptography
- Hash-chain + Merkle proof of inclusion per event
- Any change breaks the chain, mathematically detectable
- Independent of policy: nothing to "turn off"
- Multi-validator PoA consensus: no single node rewrites history
The three questions a configuration lock can't answer
Immutable to whom?
A lock the admin can revert doesn't protect against the insider with credentials: the attacker who erases their own trail first.
Prove it after the fact?
If a record was altered, can you detect which one and prove it? Hash-chain proves. Configuration only tries to prevent.
Who is the trust anchor?
Not the platform itself. Multi-validator consensus distributes trust, so no single node rewrites history.
ImmutableLog doesn't prevent tampering by policy. It makes tampering mathematically detectable and verifiable by third parties.
System Architecture
From Event to Verifiable Evidence
Every critical event passes through seven stages before it becomes proof. None of them is optional: that's what separates a log from an audit trail. The Core preserves first. The SIEM analyzes after.
- 1
POST: API ingestion
Your application sends a critical event (a user action, configuration change, transaction, or automated decision) through an authenticated POST.
- 2
Validation
The event is validated against schema and signature. Invalid payloads are rejected before they touch the ledger.
- 3
Distribution
The event is replicated across the cluster nodes. No single node can unilaterally decide what enters the chain.
- 4
Consensus
Nodes agree on the order and content of the event before accepting it. No consensus, no record.
- 5
Chaining
A deterministic hash links the event to the previous block, forming a chain where altering the past breaks the entire future.
- 6
Persistence
The block is written to append-only storage. Events cannot be edited or deleted, not even by administrators.
- 7
Future verification
Auditors, regulators, or your own systems can cryptographically prove the event happened, months or years later.
quickstart.sh
# Record a critical event
curl -X POST https://api.immutablelog.com/v1/events \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"event_type": "admin_access",
"actor": "admin_01",
"action": "delete_database",
"timestamp": "2026-01-30T14:20:00Z"
}'Production-ready API integrationRead the docs →
The system's real objective
It isn't about storing logs.
It's about turning critical events into visibility, detection, audit trails, and verifiable evidence.
integrityauditabilitycryptographic prooftraceability
View technical architectureAudit Console Preview
From Event to Defensible Evidence
Inspect sealed records, navigate the chain of proof, and export cryptographic evidence from a single audit interface.
Every record, sealed and verifiable
The Evidence Ledger shows every sealed record with its block reference in the chain. Export to CSV or search by name and payload.
- Block reference per record
- CSV export for auditors
- Search by tx ID or payload
- Cursor-based pagination
This is the evidence-focused view of the platform, built for audit, export, and verification.
Risk Scenarios
From Observed Event to Verifiable Proof
Every organization has moments of exposure. These are the ones where cryptographic evidence changes the outcome.
S/01 · 08
Know What Every Admin Did, and Prove It
A support lead in your SaaS platform can grant refunds, change plan tiers, and disable other users' accounts. Six months later, a customer disputes a refund that was never approved.
Customer Success Ops · CTOWhy this matters
ImmutableLog's SIEM surfaces every admin action as it happens, who did it, from where, on what account, so your team can investigate immediately. Each action is also cryptographically sealed into the chain when it is recorded, along with proof of inclusion, so the record stands even if the admin account itself is compromised later.
S/02 · 08
Turn Suspicious Logins Into an Investigation, Not a Guess
Your monitoring shows a spike in failed logins against a customer-facing API. Is it credential stuffing, a misconfigured integration, or a customer who forgot their password?
Security Lead · EngineeringWhy this matters
ImmutableLog's SIEM detects the pattern, source IP, velocity, targeted accounts, and raises an alert your team can act on within minutes. Every authentication event behind that alert is stored as a tamper-evident record, so the investigation rests on verifiable evidence, not a dashboard screenshot.
S/03 · 08
Answer 'Show Me Your Audit Trail' the Same Day
A prospective customer's security team asks for your audit log retention policy and a sample export before signing. Your logs are scattered across three services, none of them tamper-evident.
Sales Engineering · ComplianceWhy this matters
ImmutableLog gives you one continuous, filterable audit trail across every service that sends events. When the request comes in, you export a package with cryptographic proof of integrity attached, not a CSV you have to vouch for.
S/04 · 08
Investigate a Data Access Incident Without Trusting the Suspect's Own Logs
A support engineer at your healthtech is suspected of viewing patient records outside their assigned cases. The application logs that would prove it are controlled by the same team the engineer belongs to.
CISO · Legal · HRWhy this matters
ImmutableLog ingests access events independently of your application's own logging path, so the record isn't something the team under investigation can quietly edit. Legal and HR get a timeline they can verify cryptographically, not one they have to take on faith.
S/05 · 08
Hold Privileged Access Accountable, Even From Your Own Team
A DBA or infrastructure engineer at your insurtech has production database access and, in principle, the ability to cover their own tracks. How do you prove, to an auditor or to yourself, what they actually touched?
IT Governance · CISOWhy this matters
ImmutableLog's SIEM flags privileged actions as they happen, queries against sensitive tables, config changes, credential use, and each one is sealed before it reaches your systems, independent of the admin and independent of the database. Any auditor can verify it without trusting your word.
S/06 · 08
Satisfy Regulators With Evidence, Not Assertions
LGPD, SOC 2, ISO 27001, and sector regulators require you to prove, not just claim, that controls were applied. Self-reported logs from your own systems aren't enough on their own.
DPO · Compliance LeadWhy this matters
ImmutableLog's SIEM gives your compliance team the day-to-day view of controls in action. Every underlying event also carries a cryptographic proof of inclusion, so when a regulator asks for evidence, you hand over something independently verifiable, not a report they have to take at your word.
S/07 · 08
Catch API Abuse Before It Becomes a Breach Report
Your ERP SaaS exposes a partner API. One integration partner starts pulling far more records than their contract allows, or an API key leaks and someone else starts using it.
Platform Engineering · SecurityWhy this matters
ImmutableLog's SIEM correlates API key, endpoint, volume, and origin to flag abnormal usage as it happens. Every API call tied to the incident is already an immutable, cryptographically sealed record, so your response rests on evidence, not reconstruction.
S/08 · 08
Trace Every Production Change Back to Who Approved It
A configuration change in your HRTech's deployment pipeline breaks payroll calculations for a client. Was it reviewed? Who merged it? Was it the change that shipped, or a later one?
Platform Engineering · Engineering LeadershipWhy this matters
ImmutableLog's SIEM gives you the timeline of every deploy, config change, and approval as it happens. Each event is cryptographically sealed into the chain at ingestion, so the sequence you show the client, or use in a post-mortem, can't be quietly edited after the fact.
The audit doesn't announce itself. Your evidence layer should be ready when it arrives.
Industries
Industries That Depend on Observe, Detect, Audit, Prove
ImmutableLog is built for organizations where verifiable evidence is not optional.
BACEN 4.893
Fintechs & Financial Institutions
Payment fintechs, lending platforms, digital banks and payment operators regulated by BACEN. Resolution 4.893 requires immutable records of critical operations and access logs.
CFM 1.821 + LGPD
Mental Health & Digital Healthtech
Telepsychology, telepsychiatry, and digital health platforms handling sensitive medical records. CFM Resolution 1.821 requires immutable clinical documentation.
CNJ 213/2025
Notary Offices & Extrajudicial Services
Notary offices, registry offices and extrajudicial services regulated by the National Council of Justice. CNJ Provimento 213/2025 mandates digital audit trails.
CPC / Arbitration
Legaltech & Digital Law Firms
Legal management platforms, arbitration chambers, and digital law firms. Evidence of process integrity and decision traceability is required in legal disputes.
TCU / LAI
Public Sector & Government
Federal, state, and municipal bodies subject to Brazil's Access to Information Law and TCU audits. Immutable records are essential for transparency and public accountability.
SUSEP / LGPD
Insurance & Insurtech
Insurance companies, insurtechs, and health plan operators regulated by SUSEP and ANS. Immutable records of claims, policy changes, and fraud investigations are essential for regulatory compliance and legal disputes.
Does your industry require provable audit history?
Compliance
Turn trusted events into audit-ready evidence.
ImmutableLog gives compliance and audit teams a continuous, tamper-evident trail: retained on your terms, filterable on demand, and exportable as a verifiable evidence package that strengthens your audit and compliance processes.
- Configurable retention: keep the audit history for as long as your compliance policy requires
- Filterable audit trail: query by actor, resource, service, or time range
- On-demand exports: hand an auditor a package, not a data dump
- Evidence packages with proof of inclusion attached to every event
- End-to-end traceability: reconstruct what happened without gaps
- Cryptographic integrity verification: any unauthorized change becomes detectable
Verifiable Integrity
Cryptographic Certificate
Chain Status: Valid
▪ ▪ ▪Nodes: 3/3 Online
SEALING · DEMO● CHAIN VALID
#48296refund_granted0xf5e8
#48295login_success0xf55f
#48294config_change0xf4d6
#48293admin_access0xf44d
#48292record_viewed0xf3c4
Mapped to controls auditors already know
LGPD Art. 46
Integrity measures: history that cannot be altered without detection.
PCI DSS 10.5
Protection of the audit trail against unauthorized modification.
ISO 27001 A.12.4.2
Protection of log information against tampering and improper access.
NIST 800-53 AU-9
Cryptographic protection of the audit trail, delivered by the hash-chain.
Blog
From the ImmutableLog team
Articles on audit, compliance, cryptography, and immutable infrastructure.
See what is happening. Detect what matters. Keep verifiable evidence from day one.
Bring observability, security detection, audit trails, and cryptographic evidence together in one platform.