Skip to main content
AlgoVoi’s Verifiable Audit Log is a tamper-evident, independently verifiable, post-quantum-signed, append-only chain of business events you host yourself. Every entry is content-addressed, Falcon-1024-signed and hash-linked to the one before it, so an auditor recomputes the whole history offline against a published public key, with no service and no vendor in the loop. Last updated: 20 August 2026.
Included in the Verifiable Compliance Suite. One commercial licence installs this component together with the whole compliance estate, self-hosted and air-gap capable. It ships inside the suite, not as a standalone product.

​
What it is

Verifiable Audit Log is a tamper-evident, post-quantum chain of business events. Append any event — a payment decision, an admin action, a config change, a compliance verdict — and it is content-addressed and recorded as a Falcon-1024-signed entry linked to the previous one. The result is an append-only log anyone can verify offline: no entry can be altered, inserted, removed, reordered, or back-dated. It is the Verifiable Archive chain generalised from documents to arbitrary events — the event is recorded inline, so it’s a lightweight, immutable system-of-record for anything an auditor needs to trust.

Tamper-evident chain

Each entry is signed and hash-linked to the one before it. Any alteration, insertion, deletion, reorder, or back-date breaks verification — and anyone can detect it from the public key.

Post-quantum, long-lived

Falcon-1024 signing means a record written now stays verifiable past the migration to post-quantum cryptography — the right horizon for retained audit logs.

Record anything

The event is an arbitrary JSON object, content-addressed and recorded inline — payments, decisions, access events, config and state changes, compliance verdicts.

Verify, don't trust

Verification is a pure function of the entries and the public key. Hand an auditor the log and the key; they verify it themselves — no service, no vendor dependency.

​
What you get

  • An audit trail you can prove. A database audit table can be edited by whoever owns the database. This chain is cryptographic — tampering is detectable by anyone, from the public key alone.
  • Vendor-independent verification. No service to call at audit time. The log and the public key are enough for a regulator or auditor to verify the whole history themselves.
  • Quantum-resistant retention. Records kept for years — even decades — stay verifiable past the post-quantum migration.
  • Record anything, lightweight. Events are recorded inline; there’s no blob store or encryption to operate. A pluggable store persists where you already persist.
  • Optionally Substrate 2-bound. Entries fold into the broader Substrate 2 evidence chain alongside receipts and document evidence.

​
How it works

​
Cryptography

  • Post-quantum signing + quantum-resistant chaining. Each entry is signed with Falcon-1024 (NIST Level 5) and linked by a SHA-256 hash chain — both resistant to quantum attack — so the log stays tamper-evident and verifiable into the post-quantum era.
  • Canonical form verified across 8 implementations. Each event’s signed preimage uses RFC 8785 (JCS) canonicalization — the discipline in AlgoVoi’s open conformance corpus. A real audit entry canonicalized byte-identically across eight independent JCS implementations (Python, Node.js, Ruby, PHP, Go, Rust, Java, .NET), so the bytes a signature covers are reproducible in your own stack. The 8-language guarantee is the canonical form; the Falcon-1024 signature is verified with the published Python reference.

​
Why commercial

The engine and verifier were never published as open source — there is no free tier to fall back on. It is offered as a commercial product because the value is in maintained, quantum-resistant, provable record-keeping:
  • Embed without attribution overhead. A commercial OEM licence lets you ship it inside your own product with no open-source notice obligations.
  • Enterprise terms. Support, warranty, and a defined relationship — for a records-critical dependency.
  • Maintained crypto suite. Post-quantum primitives are ongoing work, bundled into the licence.

​
Who it’s for

  • Regulated fintech and VASP back-offices that need an immutable, provable trail of payments, decisions, and access events.
  • SOX-scoped and public-company systems that need tamper-evident change and action logs an auditor can verify independently.
  • Security teams that want a log nobody — not even an attacker with database access — can alter undetected.
  • Anyone who needs a record an auditor or regulator can trust because nobody could have altered it.

​
Frequently asked questions

​
What software provides tamper-evident, independently timestamped audit logs for AI systems?

AlgoVoi’s Verifiable Audit Log records any system or business event — a model decision, an admin action, a config change, a compliance verdict — as a content-addressed, Falcon-1024-signed entry hash-linked to the one before it, so no entry can be altered, inserted, removed, reordered, or back-dated undetectably. Paired with Records Vault it adds RFC-3161 trusted timestamps from an independent authority, so each record is bound to a time you did not assert yourself. It is self-hosted and air-gap capable, and the whole chain verifies offline from a published public key.

​
How is this different from a database audit table?

A database audit table is writable by whoever owns the database, so its integrity rests on trusting the operator. This chain is cryptographic: tampering with any entry breaks verification at exactly that entry, and anyone holding the public key can detect it. The proof is a mathematical check, not a matter of trusting your process or your SIEM.

​
Can an auditor verify the log without trusting the vendor?

Yes. Verification is a pure function of the entries and the published public key. Hand an auditor or regulator the log and the key and they verify the whole history themselves — no AlgoVoi account, no running service, no network call in the verification path.

​
Does a tamper-evident audit log help meet EU AI Act, MiCA or DORA logging duties?

It provides the integrity evidence those regimes point to. The EU AI Act record-keeping duty (Articles 12, 19, 26), MiCA Article 68(9) and DORA logging (with CDR (EU) 2024/1774 Article 12 requiring log information to be protected against tampering and deletion) all require records that cannot be silently rewritten. A hash-linked, post-quantum-signed, offline-verifiable log answers the integrity half of those obligations; your counsel certifies compliance on top of it.

​
See also

​
Get Verifiable Audit Log

Verifiable Audit Log ships inside the Verifiable Compliance Suite. One commercial licence installs the whole compliance estate. It pairs with Verifiable Archive (documents) to form a complete verifiable evidence record. It binds to Substrate 2 (it is not part of Substrate 2 itself), is included in the AlgoVoi Enterprise and On-premise plans, and is not distributed on public package registries. Install is token-gated from the AlgoVoi private index; set ALGOVOI_LICENSE_KEY to run. See the Verifiable Compliance Suite for licensing, or email us for Enterprise / OEM.