GoodAudit

Tamper-Evident Audit Logging API

Prove every action.
Pass every audit.

GoodAudit gives your SaaS cryptographic proof that audit logs haven't been tampered with. Session recordings, consent certificates, and compliance evidence packages for TCPA, HIPAA, SOC 2, PCI-DSS, and GDPR — all from one API.

Book a Call
TCPA HIPAA SOC 2 PCI-DSS GDPR ISO 27001
Create a tamper-evident audit entry 
POST /api/v1/audit-logs

{
  "action":        "patient_chart_viewed",
  "actor_id":      "usr_8xK2mN",
  "resource_type": "medical_record",
  "resource_id":   "rec_4jP9qL",
  "outcome":       "success",
  "extensions": {
    "hipaa": { "phi_accessed": true }
  }
}

// Response: entry chained with HMAC-SHA-256
// sequence_number: 1847, checksum: "a3f8c1..."

The Problem

Your audit logs are only as trustworthy as your database admin

Traditional audit logs live in the same database as everything else. Anyone with write access can silently rewrite history — and you'd never know. When an auditor asks "prove these logs are authentic," most teams can't.

Silent Tampering

Database admins can alter or delete log entries with no trace. Standard ORMs provide zero integrity guarantees.

Manual Evidence

Audit prep takes weeks of querying, formatting, and cross-referencing logs into framework-specific evidence packages.

No Independent Proof

Self-attested logs carry no weight in legal proceedings or regulatory investigations. You need an external witness.

How It Works

Three lines of code. Cryptographic certainty.

Send events through our API. We chain, verify, and anchor them — so you can prove integrity to any auditor, regulator, or court.

1

Send events via API

Log any action — PHI access, config changes, login attempts — with a single POST. We accept your schema and validate against active compliance frameworks.

2

We chain every entry

Each entry is assigned a gap-free sequence number and an HMAC-SHA-256 checksum chained to the previous entry. Altering any record breaks the chain.

3

Export audit-ready evidence

Generate framework-specific compliance reports — HIPAA PHI access logs, SOC 2 change evidence, PCI-DSS access reports — with verified chain integrity.

Features

Audit infrastructure, not another dashboard

GoodAudit isn't a GRC platform you log into quarterly. It's the cryptographic backbone your application writes to on every action.

HMAC-SHA-256 Chain Integrity

Every audit entry is cryptographically chained to its predecessor using per-account HMAC keys. Altering, inserting, or deleting any record breaks the chain — detectable by anyone with verification access.

External Anchoring

Checkpoints are signed by an independent witness service using Ed25519 keypairs. Even if your entire database is compromised, anchored records are provably intact.

Multi-Framework Compliance

Built-in event taxonomies and report templates for HIPAA, SOC 2, PCI-DSS, GDPR, and ISO 27001. Activate frameworks per account and get pre-built evidence packages for each.

Scoped API Keys

Fine-grained permissions with public keys for read access and secret keys for writes. Scope by operation, resource, or environment. Keys are hashed at rest with prefix-based identification.

Zero-Downtime Key Rotation

Rotate HMAC keys without breaking historical verification. Versioned keys with dual-verify windows ensure continuous chain integrity during cutover. Every rotation is itself an audited event.

Session Recordings

Capture full DOM session recordings via rrweb, checksummed with SHA-256 and chained into your audit log. Replay in-dashboard or mint signed URLs for external playback.

Consent Certificates

Mint shareable, time-boxed certificate URLs that prove who consented, when, where, and to what — backed by your HMAC chain. A cryptographically stronger alternative to TrustedForm.

Smart Retention Policies

Retention is automatically computed from active frameworks — HIPAA's 6 years, PCI-DSS's 1 year, GDPR's purpose-based limits. Conflicts are surfaced, not silently resolved.

TCPA Compliance

Session recordings & consent certificates — a better alternative to TrustedForm

TrustedForm gives you a certificate. GoodAudit gives you the full picture — tamper-evident session recordings that capture exactly what a consumer saw and did, plus cryptographically chained consent certificates that prove the recording hasn't been altered. Every frame, every click, every consent event is HMAC-chained into your audit log.

When a TCPA dispute hits, you don't just have a timestamp and an IP address. You have a visual replay of the entire session, a signed consent certificate, and a cryptographic proof chain that holds up in court. See it in action at goodleads.dev — a lead generation platform built on GoodAudit's session recording and consent infrastructure.

  • Full DOM session recordings via rrweb — capture what the consumer actually saw
  • SHA-256 checksummed recordings chained to your audit log
  • Consent certificates with chain integrity proof — who, when, where, and what they agreed to
  • Shareable certificate URLs with 1-hour signed tokens — no login required
  • External replay — embed session playback in your own compliance dashboard
  • Cryptographic proof chain that survives legal discovery
See it live on goodleads.dev
GoodAudit vs TrustedForm

TrustedForm: Certificate with timestamp, IP, and page snapshot

GoodAudit: Full session recording + consent certificate + cryptographic chain proof

TrustedForm

Point-in-time snapshot

Self-attested certificate

No replay capability

Separate system to manage

GoodAudit

Full DOM session recording

HMAC-chained proof

Embeddable replay

Part of your audit infrastructure

Live example: goodleads.dev uses GoodAudit session recordings and consent certificates to provide TCPA-compliant lead generation with full visual proof of consumer consent.

Compliance Frameworks

Audit-ready evidence, not raw database dumps

Each framework defines event taxonomies, report templates, and retention rules. Activate the frameworks you need — we generate the evidence packages your auditors expect.

TCPA

Per campaign

Session recordings of consumer consent, signed consent certificates, visual proof for dispute defense, lead-level audit trails.

HIPAA

6 years

PHI access reports, user activity logs, failed authentication tracking, minimum necessary compliance.

SOC 2

1 year

Change management evidence, production access logs, incident response timelines, control activity summaries.

PCI-DSS

1-3 years

Cardholder data access logs, key management reports, network access tracking, privileged user activity.

GDPR

Purpose-based

Records of processing activities, data subject request logs, consent tracking, cross-border transfer records.

ISO 27001

3 years

Information security event logs, access control evidence, incident management records, management review data.

Custom

Configurable

Define your own event taxonomies, validation rules, and report templates. Map internal actions to any framework.

External Anchoring

Independent proof your logs existed — even if your database is compromised

An HMAC chain proves internal consistency, but the same system that stores your logs also stores the checksums. Anyone with full database access could rewrite both. That's why GoodAudit anchors checkpoints to checksum.dev — an independent cryptographic witness service.

Every hour, GoodAudit submits your chain's checkpoint data to checksum.dev, which signs it with Ed25519 keypairs and stores the receipt independently. Once anchored, your audit trail is provably intact — verifiable by auditors, regulators, or courts without trusting GoodAudit's infrastructure at all.

  • Ed25519 digital signatures on every checkpoint
  • Independent storage — survives full database compromise
  • Automatic hourly anchoring with retry for missed checkpoints
  • Offline verification via public JWKS endpoint
  • Key lifecycle tracking — rotation, revocation, trust status
Learn more about checksum.dev
How anchoring works
1

GoodAudit creates a checkpoint

Chain head checksum + sequence number + timestamp

2

Checkpoint sent to checksum.dev

POST /api/v1/anchors

3

checksum.dev signs with Ed25519

Returns signature, anchored_at, signing_key_id

4

Receipt stored on both sides

Independent proof — verifiable without trusting either system

Zero-trust verification: Auditors can verify anchored checkpoints directly against checksum.dev's public JWKS endpoint — no access to GoodAudit required.

Developer Experience

Built for engineers, trusted by auditors

A clean REST API with OpenAPI specs, typed SDKs, and scoped API keys. No agent to install, no SIEM to configure. Send structured events — we handle the cryptography, chaining, and compliance mapping.

  • OpenAPI 3.1 spec with interactive docs
  • Cursor-based pagination for high-volume queries
  • Webhook notifications for chain verification events
  • Extensible event schema with typed JSONB extensions
  • Multi-tenant isolation with per-account HMAC keys
Verify chain integrity 
GET /api/v1/chain/verify

{
  "status":     "intact",
  "entries":    184,729,
  "gaps":       0,
  "checkpoints": 2,847,
  "anchor_results": {
    "anchored":    2,841,
    "pending":     6,
    "signatures":  "all_valid",
    "key_status":  "trusted"
  }
}

Why Teams Switch

From weeks of audit prep to minutes

93%

Reduction in audit prep time

<50ms

Median API response

5 min

To first audit entry

Stop hoping your logs are trustworthy.
Start proving it.

Ship your first tamper-evident audit entry in under 5 minutes. No credit card required.

Book a Call
GoodAudit

Tamper-evident audit logging for compliance-first teams.

© 2026 GoodAudit. Built by Goodway.