How the record is protected.

1What we hold

By default Auditant stores metadata and cryptographic hashes: who acted, which tool, when, the outcome, the policy decision, and the SHA-256 of every input and output. It does not store the payloads. Integrity is still fully provable, because the hashes are what chain.

Two other custody modes exist. Payloads can land in your own object storage while we hold only the chain, or with us for teams who prefer the convenience. Full custody is never the default, and is not offered for health or cardholder data.

2How the record is protected

Each event carries the hash of the one before it, so altering any field breaks every link after it. The chain head is signed with ECDSA P-256 every five minutes and countersigned by an independent RFC 3161 timestamp authority, which is what converts “signed” into “existed before this moment”.

Checkpoints are written to S3 Object Lock in COMPLIANCE mode, where an object cannot be deleted or overwritten before its retain-until date by anyone, including the account root. The service that writes them holds no delete permission at all.

In storage, UPDATE and DELETE on the events table are refused by database trigger rather than by application convention, so a direct connection that bypasses the application is refused too.

3What we do not claim

Auditant is not SOC 2, ISO 27001 or HIPAA certified. If a certification matters to your procurement, ask and we will tell you where we actually are rather than gesture at a roadmap.

Verification proves records were not altered after their checkpoint anchored. It does not prove completeness: an action that never reached Auditant is not in the log, and no signature can say otherwise. Coverage is a function of your deployment, and our reports never conflate the two.

The exposure window equals the checkpoint interval, five minutes by default. Events are provably unaltered from the moment their checkpoint anchors, which is a narrower claim than continuous notarisation and the one we make.

4Access

Sign-in is by emailed link only. There is no password database to steal, link tokens are stored as hashes and work exactly once, and sessions are revocable rows rather than self-asserting tokens.

Every sign-in, sign-out and refused attempt is appended to the same chain as everything else. A system of record that does not record its own privileged access is refusing the question it exists to answer.

5Reporting something

If you believe you have found a vulnerability, email augusta@auditant.co with enough detail to reproduce it. We will confirm receipt, and we will not pursue anyone who reports in good faith and does not access data that is not theirs.