Ledger
Durable history
Every security-relevant event, written once and retained. Tamper-evident by construction: entries are appended with their hash chain, and there is no edit path from inside the product.
Record — Evidence
Ledger. Trace. Pulse.
Evidence survives the incident.
Ledger, Trace and Pulse. A durable event history, the means to reconstruct how a decision propagated, and the current operational state — with raw evidence preserved separately from its searchable index.
Trace
Reconstruction
How a decision propagated. Trace follows a single event across services, policy evaluations and boundaries, so an investigator can answer what happened rather than infer it.
Pulse
Current state
What is true right now. Pulse carries live operational and security state — coverage, posture, active enforcement and open incidents — separate from the historical record.
Properties
What the record guarantees.
Signed telemetry
Every contributing signal carries a SCEF signature that is verified on ingestion. Telemetry that fails verification is retained and reported, never silently dropped.
Searchable indexes
Events are indexed in PostgreSQL so an investigator can find the relevant moment without replaying an entire estate's history.
Raw preservation
Original evidence is written to R2 unmodified, separate from its index. The index can be rebuilt; the evidence cannot.
Tamper-evident history
Ledger entries are appended with a hash chain. Alteration is detectable, and there is no edit endpoint from inside the product at any role.
Timestamps and hashes
Each entry carries an ingestion timestamp and content hash, so ordering and integrity can be checked independently of the display.
Incident timelines
Trace assembles the spans belonging to one incident into a sequence an investigator can read, rather than a log they must reconstruct.
Sentinel preserves evidence and makes integrity verifiable. It does not assert legal admissibility or certify compliance with any particular regime — that assessment belongs to your counsel and auditors.