Enterprise editionYour infrastructure
Evidence,
not logs.
nit already decides who may read what, and records it. This answers the next question, and only the next question: how do you prove the record is what happened?
If nobody outside your company is ever going to ask you that, stop here. The free edition already records it and you should use that.
01 The problem with your own log
A register you can edit proves nothing to a third party.
A log is a claim. Evidence is a claim somebody else can check.
An audit trail in an ordinary database is one its administrators can rewrite, and nothing in the data would show it. That is not an accusation — it is the reason nobody outside your company can be asked to rely on it. An auditor, a customer's security review, a regulator, a court: none of them can take “our logs say so” from the party the question is about.
You cannot fix that by being trustworthy, and you cannot fix it by moving the log somewhere else. You fix it by signing each decision where it is made, with a key the thing that stores it does not have.
02 What we do instead
The control plane keeps the half of the key that can write. The vault gets the half that can only check.
Your deployment signs every decision
Every allow and every refusal, with an Ed25519 key that never leaves your nit control plane. Not in the vault, not in a backup of it, and never sent anywhere.
The vault holds only the public half
It can check a signature and cannot produce one. Nobody with access to the vault — its administrators, its database, its backups — can write a record in your control plane's name. That is a property of the arithmetic, not of anybody's policy, which is the difference between a guarantee and a promise.
Anyone can check it, including someone who distrusts you
A verification tool reads the whole archive back and checks every signature. An auditor does not have to take the operator's word for the trail, and that is what makes it evidence rather than a log.
Gaps are visible
Batches are numbered inside what is signed. A signature proves that what is there is what you sent; the numbering is what shows you a batch that never arrived.
03 The rest of it
Your own directory
Entra ID, Okta, Ping, or Active Directory, over OIDC or LDAP. Switch somebody off there and they are out of the vault at the same moment, with no local password left working. That is the hole this closes; it is not a convenience.
Your groups do not decide what anyone may do here
Directory groups are synchronised, and granting rights over the trail stays yours to do, in one place, on the record. A group named in your directory does not silently become an authorization here.
Retention, and a legal hold
Keep the trail as long as your obligation says and not a day longer. A hold stops deletion entirely while counsel says so — including the retention policy that would otherwise be quietly destroying the thing somebody was required to keep.
An auditor who is not your employee
A read token that expires on its own, or a sign-in for a person that you can end. Either reads the trail and neither can write one — the endpoint that receives records takes no credential at all.
A pull-through cache for a fleet
Object storage instead of a shared disk, and one cache in front of the whole fleet of workers. Less a feature than "it does not fall over at a hundred workers".
Everything the free edition does
Unchanged. Nothing is switched off to make room for this. Turn the vault off and your deployment carries on exactly as it did.
04 How one of these starts
With an email. There is nothing to click.
The vault is part of the enterprise edition, and the enterprise edition is licensed rather than sold from a page. No checkout, no sign-up, no trial.
- You say what you keep and for how long. Which company, how many deployments, how many days the records have to survive, and who administers the vault.
- It runs on your infrastructure. Your machines, your network, your database, your backups. We can deploy it with you, or you take the binaries and deploy it yourself — whichever suits how you already run things.
- You generate the signing key on your own machine. The private half stays in the control plane; the vault is registered against the public half and never sees the other one. If anybody ever asks you for it — us included — that is the moment to refuse.
- The first batch arrives and its signatures are checked. A mismatch found now is a configuration question; the same mismatch in six months is an incident.
No evidence leaves your estate at any point, and none of it reaches us. That is not a promise about our conduct — there is nowhere for it to go.
05 Who does not need this
Probably you.
Said plainly, because selling it to the wrong person wastes their money and our reputation.
A person on their own, or a team of five, has no reason to pay for this. Nobody is going to ask them to prove anything, and the free edition already records it.
What you are buying is the ability to hand the record to somebody who has no reason to take your word. If nobody is going to ask, you are paying for an argument you will never have.