Tamper-Evident Audit Infrastructure

Immutable audit records.
Independently verifiable.
On your infrastructure.

Settled provides cryptographically immutable audit logs with inclusion and consistency proofs verifiable by regulators, auditors, and external parties — without requiring server access or vendor involvement.

On-premises deployment RFC 6962 compliant Open source
Audit Log — click ✎ to edit any entry
#EntryChain Hash
VERIFIED
Supports compliance with
SOX GDPR HIPAA GxP / 21 CFR Part 11 DORA ISO 27001 FedRAMP and many more…
The Challenge

Audit records that can be altered
provide no audit assurance.

Organisations in every regulated sector invest heavily in audit infrastructure, yet most implementations share a fundamental weakness: a sufficiently privileged operator can rewrite history without detection.

I.

Database Audit Tables

Standard append-to-table audit logs offer no cryptographic assurance. Any user with database write access — including DBAs, backup systems, and compromised service accounts — can alter or delete records without trace.

No tamper detection
II.

Third-Party SaaS Audit Platforms

Managed logging services introduce vendor dependency into your regulatory chain. Data custody leaves your environment. Verification of record integrity requires trusting the vendor's infrastructure and attestations.

Vendor dependency
III.

Existing Open-Source Solutions

Cryptographically correct alternatives such as Immudb and Trillian exist but are built primarily for Go ecosystems, lack enterprise deployment tooling, and provide limited SDK support for the languages used across regulated industries.

Ecosystem mismatch
Architecture

From record submission to
independently verifiable proof.

Four deterministic steps, each cryptographically bound to the next. The integrity of any record can be demonstrated to a regulator or external auditor without granting access to the system.

01

Submit

The client submits a record identifier and payload. The server assigns a monotonically increasing sequence number and acknowledges durably via write-ahead log before responding.

WAL-durable · append-only
02

Chain

Two hashes are computed. A leaf hash (RFC 6962 domain separation) is inserted into the Merkle tree. A chain hash binds this entry to every entry before it — modifying any record cascades a changed hash through the entire subsequent log.

SHA-256(prev ‖ leaf)
03

Anchor

Periodically, the server signs the current Merkle root and tree size with Ed25519, producing a Signed Tree Head. This snapshot is publishable to regulators as a point-in-time commitment to the entire prior log.

Ed25519 · 48-byte payload
04

Verify

Entries before an anchor are verifiable with an O(log n) Merkle inclusion proof. Entries since the last anchor are verified by walking the hash chain. No server connection required at verification time.

O(log n) · client-side
Security Properties

Designed around the properties
that matter to regulators.

Every design decision in Settled traces back to a single invariant: a valid proof must be valid everywhere, always, without requiring trust in the originating system.

Cryptographic Immutability

Modifying any committed record changes its chain hash, which cascades through every subsequent entry. Against a published snapshot, recalculating the chain is insufficient — the Merkle root no longer matches the signed anchor. Tampering is detectable without access to the original data.

Independent Verification

Proofs are verifiable by external auditors, regulators, and counterparties using only the server's public key. No API access, no vendor involvement, no ongoing service dependency.

Consistency Proofs

A party holding a historical Signed Tree Head can verify a newer one using O(log n) hashes — no entries need to be re-read. Proves that every entry present at the earlier snapshot is still present and unchanged in the later one. Does not verify the content of entries added between the two snapshots.

Auditable Key Rotation

Each signing key rotation is countersigned by the preceding key, creating a verifiable chain of custody. Historical proofs remain valid across key rotations; rotation events are themselves auditable.

On-Premises Data Custody

All audit data, signing keys, and proof material remain within your infrastructure perimeter. No data is transmitted to external services. Suitable for air-gapped environments.

Crash-Safe Storage

RocksDB write-ahead log ensures durability. The Merkle tree CF is fully reconstructible from the immutable log. Recovery procedures are deterministic and testable.

Deployment

Deployed within your security perimeter.

Settled is a single-binary service with no mandatory external dependencies. It can be operated within the most restrictive infrastructure policies.

Option I

On-Premises

Deployed directly onto your own hardware or private data centre infrastructure. No cloud dependency. Suitable for air-gapped regulatory environments.

  • Full data sovereignty
  • Integrates with existing HSM infrastructure
  • Supports air-gapped deployment
  • No external network egress required
Option II

Private Cloud (VPC)

Deployed within your organisation's private cloud tenancy on AWS, Azure, or GCP. Traffic never leaves your Virtual Private Cloud.

  • VPC-isolated deployment
  • KMS integration for key management
  • Infrastructure-as-code templates provided
  • Compatible with cloud-native HSM services
Option III

Hybrid Verification

Audit log remains on-premises. Signed Tree Heads can optionally be published to independent external verifiers for regulatory cross-attestation.

  • Log data never leaves your perimeter
  • External verifier anchors for regulators
  • Configurable Maximum Merge Delay
  • Supports threshold counter-signatures
Comparison

Capability assessment across
audit infrastructure options.

Evaluated against the criteria most frequently cited in regulated industry audit and compliance frameworks.

Capability Settled Database Audit Table Managed SaaS Immudb / Trillian
Cryptographically immutable records
Independent third-party verification
Consistency proofs across time
On-premises deployment
No vendor trust required at verify time
Multi-language SDKs (TypeScript, Python, Go, Java, .NET, Rust)
HSM / KMS key management support variesvariespartial
Open source, auditable codebase
Get in Touch

Ready to evaluate Settled?

Request a technical demonstration, ask a question about the architecture, or discuss deployment options for your organisation.

We typically respond within one business day.

No spam. Your details are used only to respond to your enquiry.

Message sent — we'll be in touch shortly.
Something went wrong. Please try again or email us directly.