The audit log that proves itself.
Sigilbase chains, seals, and signs every event your systems record, and ships a standalone verifier so evidence stands on its own.
Anyone with database access can rewrite an audit table.
Auditors are asked to trust screenshots and CSV exports.
Logging tools prove events were received, not that history is intact.
Four steps from event to evidence.
POST /v1/events
{
"actor": "svc:billing",
"action": "invoice.voided",
"payload": {
"invoice_id": "inv_9f21",
"reason": "duplicate"
}
}
seq 40919 export.requested
data 0e28…f5aa
prev b71c…9d40 (event 40918)
hash = SHA256(data ‖ prev)
→ 0e28…f5aa
seq 40920 checkpoint.sealed
prev 0e28…f5aa
→ 6c14…8b02
checkpoint #4192 events 40901 – 40920 merkle_root 6c14…8b02 sealed_at 2026-07-08T09:14:02Z algo ed25519 key_id key_9f0a…2d17 signature MEUCIQ…c4b1
$ sigil export --from 40901 --to 40920 wrote evidence-bundle.tar 2,481 events, 7 checkpoints $ sigil-verify ./evidence-bundle.tar hash chain ......... ok inclusion proofs ... ok signatures ......... ok
An auditor never has to take our word for it.
reading evidence-bundle.tar
events 2,481
checkpoints 7
recomputing hash chain ... ok
verifying inclusion proofs ... ok
verifying Ed25519 signatures ... ok
verified: 2,481 events intact, 0 breaks
The events, their hash chain, the Merkle inclusion proof for each event, the signed checkpoints, and the public signing keys. One file, no database access required.
It runs offline and depends on nothing from Sigilbase, your application, or your database. It reads the bundle, recomputes the chain, and checks every signature itself.
A modified, deleted, or reordered event fails verification. The failure names the sequence number, so you know exactly which record broke.
Join the waitlist
Building now. Early access for teams preparing SOC 2, ISO 27001, or PCI DSS evidence.
Could not save your email. Try again or write to hello@sigilbase.io.
No spam, one email when it opens.