xAudit: Distributed Audit Logs

The Problem

Centralized audit logs can be tampered with by insiders or attackers who gain admin access. There is no cryptographic guarantee of log integrity, and no way to detect selective deletion or modification of entries.

Audit logs are the foundation of compliance -- SOC 2, SOX, HIPAA, and every regulatory framework requires immutable records. Yet most audit systems store logs in a single database where a compromised admin can modify, delete, or backdate entries without detection.

Even "append-only" log systems fail when the storage administrator has root access. Database-level immutability is a software constraint, not a cryptographic guarantee. An attacker with sufficient access can always modify the underlying storage.

The Old Way

The PRIVATE.ME Solution

Every audit entry includes an HMAC-SHA256 hash of the previous entry, creating an unbreakable cryptographic chain. Entries are split across independent storage nodes via XorIDA. Tampering with any entry breaks the chain and is immediately detectable.

xAudit combines hash chaining (each entry references its predecessor) with distributed storage (entries split across independent nodes). An attacker would need to compromise K-of-N storage nodes AND recompute the entire HMAC chain from the point of tampering -- which requires the HMAC key.

DID-based identity ensures that each log entry is signed by the originating service. The chain verifier can confirm not just that the chain is intact, but that each entry was produced by an authorized source.

The New Way

How It Works

Append-only HMAC chain with distributed storage. Each entry includes: timestamp, event data, DID signature, and HMAC of the previous entry. The chain is verified from genesis to tip on every audit query.

Use Cases

Integration

import { appendEntry, verifyChain } from '@private.me/xaudit';

// Append a new audit entry to the chain
const result = await appendEntry({
  action: 'record.accessed',
  actor: 'did:key:z6Mk...',
  resource: 'patient/12345',
  timestamp: Date.now(),
}, auditChain);

// Verify the entire chain is intact
const valid = await verifyChain(auditChain);
// valid.ok === true if no tampering detected

Security Properties

Cryptographic Proof of Correctness

This ACI's computations can be cryptographically verified by xProve — so regulators, auditors, and counterparties can confirm results without re-running the computation or accessing the underlying data.

Ready to deploy xAudit?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xAudit generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases