DurbarAI
Get notified

Audit log and evidence

A record that shows if anyone edits it

DurbarAI writes agent events, approvals and policy changes to a hash-chained audit log. Each event is linked to the one before it, checkpoints over the chain are signed, and Verify recomputes the whole chain on demand. When an auditor asks what an agent did and who approved it, you export the answer.

DurbarAI compliance evidence board: signed evidence bundles listed per control, such as CC6.1 and CC8.1, with download, verify and attest actions.
Compliance evidence: one signed bundle per control and week, each with its own Verify button.

How does the chain work?

Every event's hash covers its own content and the previous event's hash, and each hash is signed with an HMAC. Change, insert or delete an event and every link after it stops matching. A checkpoint builds a Merkle tree over the chain and signs the root with Ed25519, which fixes the state of the log at that moment.

What is in the log?

Policy changes are written strictly: if the audit write fails, the change fails. Approval decisions are recorded with the approver's identity. Run receipts, the per-step trail of what an agent did, are written best-effort, so a run can finish even if its receipt could not be stored.

What can I hand to an auditor?

Evidence bundles group the relevant events by SOC 2 control (for example CC6.1, CC6.3, CC7.2 and CC8.1) and by week, and each bundle is signed. A reviewer can download a bundle, verify its signature, and attest access reviews in the same screen. Raw events export as JSONL or CEF.

Limits: the per-event HMAC uses the deployment secret, and the signing key is derived from the same secret, so whoever operates the deployment holds both. The log exposes edits by anyone without those keys; it is not proof against the operator. A missing run receipt is not flagged on its own. Prashna Labs has no SOC 2 report.

Questions people ask

How is the audit log protected?

Each event's hash covers the previous event's hash, and each hash is signed with an HMAC. Checkpoints over the chain are Merkle roots signed with Ed25519. The HMAC key and the signing key both derive from the deployment secret, which the operator holds.

How do I verify it?

Open Audit log, then Integrity, and press Verify now, or call the verify endpoint. DurbarAI recomputes the chain end to end and reports the first event that does not match.

Can I export it to my SIEM?

Yes. Search and filter events in the audit log, then export them as JSONL or CEF.

Hear the day DurbarAI goes public

One email when the repository opens. No newsletter, and we delete the address after that if you ask.

Email us to get notifiedEmail us for a 25-minute call

Opens your email app with the subject filled in. Or write to hello@prashnalabs.com.