> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Verifiable Audit Log
> Append any business event to a tamper evident, post quantum chain. Entries are content addressed, append only and verifiable offline. Commercial OEM SDK.
**Also in the on-prem suite.** This product is included in the [AlgoVoi Compliance and Payments On-Prem Suite](/substrate-2), one commercial licence that unlocks and runs the complete self-hosted platform.
## What it is
**Verifiable Audit Log** is a tamper-evident, post-quantum chain of business events. Append any event —
a payment decision, an admin action, a config change, a compliance verdict — and it is content-addressed
and recorded as a **Falcon-1024-signed** entry linked to the previous one. The result is an
**append-only log** anyone can verify offline: no entry can be **altered, inserted, removed, reordered,
or back-dated**.
It is the [Verifiable Archive](/verifiable-archive) chain generalised from *documents* to *arbitrary
events* — the event is recorded inline, so it's a lightweight, immutable system-of-record for anything
an auditor needs to trust.
Each entry is signed and hash-linked to the one before it. Any alteration, insertion, deletion,
reorder, or back-date breaks verification — and anyone can detect it from the public key.
Falcon-1024 signing means a record written now stays verifiable past the migration to post-quantum
cryptography — the right horizon for retained audit logs.
The event is an arbitrary JSON object, content-addressed and recorded inline — payments, decisions,
access events, config and state changes, compliance verdicts.
Verification is a pure function of the entries and the public key. Hand an auditor the log and the
key; they verify it themselves — no service, no vendor dependency.
## What you get
* **An audit trail you can prove.** A database audit table can be edited by whoever owns the database.
This chain is cryptographic — tampering is detectable by anyone, from the public key alone.
* **Vendor-independent verification.** No service to call at audit time. The log and the public key are
enough for a regulator or auditor to verify the whole history themselves.
* **Quantum-resistant retention.** Records kept for years — even decades — stay verifiable past the
post-quantum migration.
* **Record anything, lightweight.** Events are recorded inline; there's no blob store or encryption to
operate. A pluggable store persists where you already persist.
* **Optionally Substrate 2-bound.** Entries fold into the broader [Substrate 2](/substrate-2) evidence
chain alongside receipts and document evidence.
## How it works
| Step | What happens |
| --------------- | ------------------------------------------------------------------------------ |
| **Append** | Submit an event; it is content-addressed (`sha256` of its canonical form). |
| **Sign + link** | The entry is Falcon-signed and linked to the previous one (`prev_entry_hash`). |
| **Verify** | Check any entry — or the whole chain's integrity and ordering — offline. |
## Cryptography
* **Post-quantum signing + quantum-resistant chaining.** Each entry is signed with Falcon-1024
(NIST Level 5) and linked by a SHA-256 hash chain — both resistant to quantum attack — so the log
stays tamper-evident and verifiable into the post-quantum era.
* **Canonical form verified across 8 implementations.** Each event's signed preimage uses RFC 8785
(JCS) canonicalization — the discipline in AlgoVoi's open [conformance corpus](/conformance-vectors).
A real audit entry canonicalized byte-identically across eight independent JCS implementations
(Python, Node.js, Ruby, PHP, Go, Rust, Java, .NET), so the bytes a signature covers are reproducible
in your own stack. The 8-language guarantee is the canonical form; the Falcon-1024 signature is
verified with the published Python reference.
## Why commercial
The engine and verifier were never published as open source — there is no free tier to fall back on.
It is offered as a **commercial product** because the value is in maintained, quantum-resistant,
provable record-keeping:
* **Embed without attribution overhead.** A commercial OEM licence lets you ship it inside your own
product with no open-source notice obligations.
* **Enterprise terms.** Support, warranty, and a defined relationship — for a records-critical
dependency.
* **Maintained crypto suite.** Post-quantum primitives are ongoing work, bundled into the licence.
## Who it's for
* **Regulated fintech and VASP back-offices** that need an immutable, provable trail of payments,
decisions, and access events.
* **SOX-scoped and public-company systems** that need tamper-evident change and action logs an auditor
can verify independently.
* **Security teams** that want a log nobody — not even an attacker with database access — can alter undetected.
* Anyone who needs **a record an auditor or regulator can trust because nobody could have altered it**.
## Get Verifiable Audit Log
Verifiable Audit Log is an **additional, separately-licensed package** — an add-on that binds to
Substrate 2, not part of Substrate 2 itself. It pairs with [Verifiable Archive](/verifiable-archive)
(documents) to form a complete verifiable evidence record. It is available **self-serve as a Starter licence (perpetual one-time or annual)** (see below) and as a **commercial OEM SDK**
and is included in the AlgoVoi Enterprise and [On-premise](/on-premise) plans. It is not distributed on
public package registries.
Starter licence — **perpetual (one-time) or annual subscription**, self-hosted, paid in **USDC** on mainnet; the [store](https://api.algovoi.co.uk/suite-store) shows current pricing for both and issues your licence key + install command on settlement; install from the private index and set `ALGOVOI_LICENSE_KEY` to run. Enterprise / OEM (warranty, indemnity, SLA, multi-deployment, Substrate 2 binding): [email us](mailto:hello@algovoi.co.uk).