Product · Security & Compliance
A tamper-evident audit trail of record for your applications. Stream audit events into a hash-chained, multi-tenant ingestion API, then search, verify, alert on, forward, and prove them — so when an auditor or an incident asks “who did what, when, and did anyone touch the log,” you have cryptographic proof.
SHA-0
Per-tenant hash chain
0
SIEM & storage connectors
0
Dependency-free SDKs
0%
Tamper-evident & verifiable
Overview
Point any application — service, internal tool, or third-party integration — at a single ingestion API and get an append-only, hash-chained record of every meaningful action. From the first event to a signed checkpoint and a compliance PDF, the whole audit story lives in one secure, verifiable place.
Events (24h)
48.2k
Failure rate
0.4%
Chain
Intact
The audit trail of record
Built around how audit trails actually get used — fast ingestion, live search, cryptographic verification, alerting, and forwarding, all connected.
External apps push single or batch events over a simple Bearer-key REST API. Each tenant gets a SHA-256 hash chain — hash(n) = sha256(canonical(event_n) + hash(n-1)) — committed under a per-org advisory lock so a chain can never fork.
Filter by action, actor, severity, status, full-text, and time range, with keyset pagination that stays fast on an append-only firehose. A per-event drawer recomputes the content hash and shows a verified badge.
A "Go live" toggle opens a Server-Sent-Events tail that prepends newly-committed events in real time, respecting the active filters. Export the current filtered set as CSV, JSON, or NDJSON — streamed oldest-first in chain order.
"Verify chain" re-walks the chain in capped batches and reports the first content or link break with the offending seq and hashes — independent, mathematical proof the log was never altered.
Per-tenant Ed25519 keys sign the current chain head for non-repudiation, with per-row signature verification. Checkpoints can be anchored to an external ledger / notary for third-party evidence the head existed.
A collapsible analytics panel pivots the filtered set by an allowlisted dimension and a time bucket (hour / day / week / month) with a horizontal bar breakdown — injection-safe, never a free-text query.
Per-event or windowed-threshold rules (≥N in W seconds), plus cross-event correlation — "a denied access followed by a successful login by the same actor within 5 min." Delivered over webhook, Slack, or email, with retry and dedup.
Per-tenant sinks push accepted events after each batch commits — off the critical path. Eight kinds: Splunk HEC, Datadog, generic HTTP, Elastic, Sentinel, and S3 / GCS / Azure Blob archival, with encrypted credentials and bounded retry.
The audit log audits itself: privileged console mutations — user, key, alert, SIEM, org, and signing changes — are written as tamper-evident events in the tenant's own hash chain, fire-and-forget, never blocking the action.
Governance & compliance
A complete compliance layer on top of the chain. Map actions to controls, monitor them continuously, and hand auditors a PDF whose evidence is independently tamper-checkable.
A seeded SOC 2 / ISO 27001 / HIPAA / PCI-DSS control catalog with per-org action → control mappings. Generate CSV / JSON / PDF evidence packages — each embedding a live chain verification so the evidence is independently tamper-checkable.
Per-control expectation rules — min activity, max failure rate, or a required action within a window — surfaced as a green/red/grey control-status board, with an admin inline expectation editor.
Partition-aware retention drops monthly partitions past the longest org retention and row-prunes the rest, on an automatic background sweep. Named, filter-scoped legal holds exempt matching events from the prune until released.
TOTP two-factor with QR enrollment and one-time recovery codes, plus per-org policy. Enterprise SSO via OIDC (Okta / Entra ID / Google / Auth0) and SAML 2.0, with JIT provisioning and a require-SSO toggle.
Invite console users with one-time passwords and inline role + status editing. Admin-only mutations, guards against last-admin removal and self-lockout, and viewers locked to read-only — all of it tamper-evidently self-audited.
Create scoped keys (ingest / read) with optional expiry and a one-time secret (stored only as a hash). Dependency-free JS/TS, Python, and Go SDKs handle auth, batching, idempotent event_id, and retry with backoff.
Drop-in ingestion
Authenticate with an API key as a Bearer token and POST one event or a batch. Only action is required; pass an event_id for idempotency. Prefer a typed client? Dependency-free SDKs for JavaScript/TypeScript, Python, and Go handle batching, retries, and idempotent IDs for you.
curl -X POST \
https://api.auditlog.dev/api/v1/ingest/events \
-H "Authorization: Bearer alk_•••" \
-H "Content-Type: application/json" \
-d '{
"action": "user.login.failed",
"actor_id": "u_42",
"severity": "warning",
"status": "failure",
"metadata": { "reason": "bad_password" }
}'Security & operations
Machine ingestion (API key, SHA-256 hash lookup) and human console (JWT) are kept fully separate and enforced by key scopes. API-key secrets are hashed with SHA-256; console passwords use bcrypt.
Signing private keys, TOTP secrets, SSO client secrets, and SIEM sink credentials are all stored AES-256-GCM-encrypted and never returned by the API — surfaced only as has_token / has_client_secret flags.
Hand-rolled security headers on every response (nosniff, frame DENY, strict CSP, COOP/CORP), opt-in HSTS behind TLS, and dependency-free fixed-window rate limiting — a tight per-IP guard on login plus a broader console limiter.
Prometheus /metrics, structured NDJSON request logging with correlation ids, and W3C Trace Context + OTLP/HTTP span export — including an ingest-commit child span — all dependency-free, with no OpenTelemetry SDK.
Designed for everyday use
Pass an event_id and duplicate sends — in-batch or across retries — collapse to a single event automatically.
Keyset pagination on seq (never OFFSET) and org-id-leading indexes keep search snappy on an append-only stream.
Per-tenant chains, keys, sinks, and retention — different tenants ingest in parallel with complete isolation.
Every endpoint documented, with Authorize and try-it-out at /api/v1/docs for both JWT and API-key auth.
A clean React console with session resume, theme switching, and toast feedback on every action.
Compliance PDFs render a visible chain-integrity attestation block from a hand-rolled, dependency-free generator.
At a glance
From ingestion to compliance evidence — every part of the audit pipeline, working together. Click any area to see everything inside it.
Push events from any app, hash-chained on arrival
Pricing
Start with a single application's audit trail and grow into a multi-tenant, compliance-grade platform. Every plan includes the tamper-evident hash chain, secure cloud hosting, and the client SDKs — no setup fees.
For one app that needs a real audit trail
Up to 1M events / month · 30-day retention · 1 tenant
Get a demo→For teams shipping compliance evidence
Up to 25M events / month · 1-year retention · 5 tenants
Get a demo→For regulated, multi-tenant platforms
Volume event pricing · custom retention · dedicated onboarding
Talk to sales→Volume event pricing on every tier. Need self-hosting, a custom retention window, or a private deployment? Talk to our team for a tailored quote.
FAQ
FalconAudit is a multi-tenant audit-log SaaS. Applications stream audit events into a hash-chained, tamper-evident ingestion API, where you can search, verify, alert on, and forward them — giving you cryptographic proof of who did what and when.
Every event is linked into a SHA-256 hash chain. If any stored event is altered or removed, the chain breaks and verification fails — so you can prove the log hasn't been tampered with.
No — it sits upstream of your SIEM as the audit trail of record. It can forward events to your SIEM while remaining the verifiable, immutable source.
Yes. FalconAudit provides per-tenant chains, keys, and retention with complete isolation between tenants.
Through an ingestion API, with dependency-free SDKs to make integration straightforward across services and languages.
Book a free 30-minute consultation. Tell us what you want to build and we'll map the fastest path to launch — no commitment required.
Free consultation · Fixed-scope quotes · NDA on request