ZenoAudit - Cryptographic Audit Logging

Philosophy

Trust Through Cryptography

AWS deprecated QLDB in 2025, leaving enterprises without a reliable open audit ledger. ZenoAudit fills that void with a Rust-core engine that makes audit integrity mathematically provable.

249+

Tests Passing

0

Unsafe Code (except FFI)

6

Language SDKs

PQ

Post-Quantum Ready

Verification

Five-Level Verification Model

From basic hash chain integrity to blockchain-anchored proofs. Choose the assurance level your compliance requirements demand.

Level 1

Hash Chain

BLAKE3 hashing (~1 GB/s) creates a tamper-evident sequential chain. Any modification breaks the chain.

Level 2

Merkle Proof

RFC 6962-style inclusion proofs. Efficiently verify any single event belongs to a signed batch without downloading all events.

Level 3

Signed Tree Head

Ed25519 digital signatures over Merkle tree roots. Cryptographic proof that the tree was produced by an authorized signer.

Level 4

Witnessed

Multiple independent co-signers witness the tree head. No single party can forge the audit trail.

Level 5

Blockchain-Anchored

Bitcoin anchoring via OpenTimestamps. Publicly verifiable, immutable proof that your audit trail existed at a specific point in time.

Developer Experience

Simple API, Powerful Verification

All the cryptographic complexity is hidden behind a clean, intuitive API. Log events in one line, verify them in another.

Transparent by Design

Developers should never need to understand Merkle trees or Ed25519 to use audit logging. ZenoAudit abstracts all cryptographic operations behind a familiar actor, action, resource model.

✓ Consistent SDKs for Python, Go, Java, Node.js, .NET, Rust
✓ Guaranteed delivery with Write-Ahead Log fallback
✓ Export portable proofs anyone can verify offline
✓ HTTP middleware, EF Core interceptor, and CDC integrations

# Log an audit event
audit.log(

                                actor="user:alice@acme.com",

                                action="secrets.read",

                                resource="vault:production/db-password",

                                context={"ip": "10.0.1.42"}
                            
)
# Verify an event
result = audit.verify(event_id)

                                # result.valid = True

                                # result.level = "signed_tree_head"

                                # result.signer = "ed25519:abc123..."

Storage

Storage-Agnostic by Design

Your verification layer is independent of your storage choice. Start with SQLite, scale to PostgreSQL, archive to S3 — all with the same API.

SQLite (Embedded)

Single-file deployment with zero external dependencies. WAL mode, monthly file rotation. Ideal for embedded and edge deployments.

PostgreSQL

Monthly RANGE partitioning with BRIN + B-tree + GIN indexes. High-throughput COPY protocol inserts at 150K+/sec.

S3 / Object Storage

S3 Object Lock for WORM compliance (SEC 17a-4, FINRA). Lifecycle policies and cross-region replication for long-term retention.

MongoDB, MS SQL, Cassandra & More

Pluggable storage trait supports any backend. Azure Table Storage, MongoDB, Cassandra, and MS SQL Server planned.

Cryptography

Post-Quantum Ready

Hybrid classical + post-quantum signatures from day one. Your audit trails remain verifiable even when quantum computers arrive.

Hashing & Integrity

BLAKE3 hashing (~1 GB/s throughput)
RFC 6962 Merkle tree with inclusion proofs
Consistency proofs between tree versions
Canonical hash format (deterministic serialization)

Signatures

Ed25519 digital signatures (classical)
ML-DSA-65 (FIPS 204) post-quantum signatures
Hybrid mode: both signatures on every batch
XMSS forward-secure key evolution

Timestamping

RFC 3161 Trusted Timestamping Authority
OpenTimestamps Bitcoin anchoring
UUIDv7 (RFC 9562) time-sortable event IDs
Publicly verifiable timestamp proofs

Compliance

Built-in Regulatory Mapping

ZenoAudit maps audit events directly to compliance framework controls. Generate evidence reports for auditors with cryptographic proofs attached.

SOC 2 Type II

Automated mapping to CC6.1, CC6.2, CC7.1, CC7.2, CC8.1 and other trust service criteria controls.

GDPR & HIPAA

Crypto-shredding for right-to-erasure without breaking audit integrity. HIPAA §164.312 audit controls built in.

PCI DSS v4.0 & NIST

Full mapping to PCI DSS 10.2–10.7 audit controls and NIST 800-53 AU-2, AU-8, AU-9, AU-10 requirements.

SEC 17a-4, DORA & More

WORM compliance for financial records, DORA Articles 9–11 for EU financial entities, ISO 27001, eIDAS 2.0, and NIS2 Directive.

Deployment

Deploy Your Way

Same Rust binary, four deployment models. Start embedded, scale to a global cluster — without changing your application code.

Embedded

SQLite backend, in-process, zero external dependencies. Ideal for desktop apps, edge devices, and single-server deployments.

Standalone Server

gRPC + REST API server with any storage backend. Service discovery, health checks, and production-ready configuration.

Clustered

Multi-node high availability with witness co-signing across nodes for maximum tamper resistance.

Kubernetes Sidecar

Inject audit logging into any pod as a sidecar container. Capture infrastructure events alongside application audit trails.

Integration

Multiple Integration Patterns

Audit logging should adapt to your architecture, not the other way around.

Application-Level

Direct SDK calls in application code
HTTP middleware for automatic API auditing
EF Core interceptor for .NET data-change auditing

Infrastructure-Level

Database CDC via Debezium
Event bus consumers (Kafka, RabbitMQ, NATS)
Kubernetes sidecar for infrastructure events

Compliance & GRC

Automated compliance evidence export (PDF)
Drata and Vanta GRC integrations
Framework control mapping reports

Comparison

ZenoAudit vs. The Alternatives

Feature	ZenoAudit	immudb	Trillian	Basic Logs (ELK)
License	Commercial	BSL 1.1	Apache 2.0	Various
Storage Backends	8+ (pluggable)	Proprietary only	Configurable	Elasticsearch
Embeddable	Yes (SQLite)	No	No	No
Post-Quantum	ML-DSA-65 hybrid	No	No	No
Compliance Mapping	7+ frameworks	Basic	None	None
Cryptographic Verification	5-level model	Hash chain only	Merkle proofs	None
Language SDKs	6 languages	4 languages	Go, Java	Various

Make Your Audit Trails Mathematically Provable

Deploy cryptographically verifiable audit logging in minutes. Start with SQLite, scale to enterprise. No vendor lock-in.

Request Demo View All Products