Features
Every feature is designed for one goal: tamper-proof, compliance-ready audit logging that you can trust.
Cryptographic Hash Chaining
Every audit event is cryptographically linked to the previous one using SHA-256. The hash is computed from the previous hash, the canonical payload, and a millisecond-precision timestamp. If any entry is modified, deleted, or reordered, the chain breaks immediately.
- SHA-256 hash of previous_hash + canonical_payload + timestamp
- Per-tenant chains with independent genesis blocks
- Millisecond-precision timestamps prevent replay attacks
- Chain verification API to prove integrity to auditors
Block #3
prev d7e1c4
hash 9b4f2a
Block #4
prev 9b4f2a
hash f1c8e3
Block #5
prev f1c8e3
hash a02d71
WORM Immutable Storage
Audit logs are written to S3 with Object Lock in compliance mode. Once written, no one can modify or delete them, not even AuditRails administrators. Retention periods are enforced by the storage layer itself, meeting the strictest regulatory requirements.
- S3 Object Lock in COMPLIANCE mode
- Configurable retention from 6 months up to 10 years, based on your active compliance frameworks
- Batched writes for cost efficiency without sacrificing durability
- Chain metadata embedded in each storage batch for verification
No one, including AuditRails admins, can shorten, edit, or delete a locked object before its retention window ends.
Real-time Search
Powered by ClickHouse, our hot storage layer indexes every field for instant search. Filter by action, actor, resource, time range, or any metadata field. Full-text search with pagination built in.
- ClickHouse-powered analytics with partition pruning
- Filter by action, actor_id, resource, time range, and metadata
- Full-text ILIKE search across all fields
- Fast full-text queries across millions of events
Multi-tenancy
Every API key maps to a tenant. Every database query, S3 path, and cache key enforces tenant isolation. There is no way to access another tenant's data, it is enforced at the infrastructure level, not just the application level.
- API key to tenant_id mapping on every request
- ClickHouse partitioned by tenant_id for query isolation
- S3 paths namespaced by tenant_id
- PostgreSQL row-level tenant filtering on all queries
Tenant A
isolated
Tenant B
isolated
Tenant C
isolated
Compliance Dashboard
A purpose-built dashboard for audit log management. View event volumes, search logs, verify chain integrity, and export reports. Role-based access lets you give auditors read-only access without exposing sensitive operations.
- Overview with event volume charts and top actions
- Chain navigation: walk forward and backward through the hash chain
- CSV export for auditor handoff
- Role-based access: Admin, Member, and Auditor roles
Role-based access
Export
5 Native SDKs
We provide native SDKs for the most popular languages and frameworks. Each SDK handles batching, retries, and error handling so you can focus on what to log, not how to log it.
- Node.js / TypeScript, @auditrails/node
- Python, auditrails (sync + async)
- Go, auditrails-go (goroutine batching, context support)
- Java, auditrails-java (builder pattern, AutoCloseable)
- PHP, auditrails-php (PSR-18 HTTP client, Composer package)
import { AuditRails } from '@auditrails/node';
const client = new AuditRails({ apiKey: process.env.AUDITRAILS_KEY });
await client.log({ action: 'user.created', actor_id: 'admin@acme.io' });Automatic Enrichment
Every event is enriched with server-side data before storage. Source IP, geo-location, normalized action names, and precise timestamps are added automatically. You send the minimum, we fill in the rest.
- Server-generated ULID for every log entry
- Source IP capture and geo-IP resolution (country, city)
- Action name normalization (lowercase, dot-separated)
- Millisecond-precision server timestamps
You send
{
"action": "user.created",
"actor_id": "admin@acme.io"
}We store
{
"action": "user.created",
"actor_id": "admin@acme.io",
"log_id": "01J8X...",
"ip": "203.0.113.42",
"geo": "DE",
"ts": "...482Z"
}Reliability and Durability
The ingestion pipeline is designed for durability. Events flow through SQS with dead-letter queues, deduplication prevents double-processing, and tiered retry strategies ensure every event reaches storage.
- SQS queue with dead-letter queue for failed messages
- Redis-based deduplication with 24-hour TTL
- Aggressive retry (5x) for cold storage writes, 3x for hot storage
- Graceful degradation: fail-open on non-critical path errors
Ready to see it in action?
Start your 90-day free trial. No credit card required.