Immutable logs

Regular logs are only as trustworthy as whoever can edit them. That includes an attacker covering their tracks, an insider, a vendor or, frankly, us. Yaya Tech systems write every significant action to a log that can be appended to but never rewritten, and anyone holding a small checkpoint can verify that nothing was altered or removed.

How it works

Hash-chained entries. Each entry includes the hash of the one before it, so changing any past entry breaks every hash after it.
A Merkle tree with signed checkpoints. Entries are organized in a Merkle tree, the same structure behind Certificate Transparency and Sigstore. Periodically the log publishes a signed checkpoint (tree size plus root hash).
External anchoring. Checkpoints are anchored outside our control: to an RFC 3161 timestamp authority, a public transparency log, or a witness you run. Rewriting history would then mean forging those too.
Written from inside the enclave. Where the system runs in confidential computing, the log writer is itself attested, so you know which code produced each entry.
WORM retention. Log segments are stored on write-once media, such as object storage with compliance-mode object lock, for the retention period you choose.
Independent verification. Your auditor gets a verifier tool and the checkpoints. Inclusion proofs show an entry is in the log, and consistency proofs show the log only grew and never changed. No need to trust us.

What gets logged, and what doesn't

Logged: agent and system actions, tool calls, approvals, access grants, operator sessions, configuration changes, deployments with their measurements, and key releases
Not logged by default: the content of prompts, documents and outputs. We practice zero retention of content, and the log carries hashes and metadata.
When you need content retained (for example electronic records under 21 CFR Part 11), it's encrypted with your keys before it's written. The log proves integrity, and only you can read it.

Why auditors like it

Immutable logs map directly onto audit-trail requirements, including:

21 CFR Part 11 §11.10(e): secure, computer-generated, time-stamped audit trails that don't obscure previously recorded information
HIPAA §164.312(b): audit controls that record and examine activity in systems containing ePHI
SOC 2 (monitoring and change-management criteria), ISO 27001 Annex A 8.15 (logging) and PCI DSS Requirement 10
NYDFS 500.6 (audit trail), DORA incident and ICT-risk evidence, and GDPR accountability

We map the controls. Your auditor attests to compliance. See Audit what you have.

Available for existing systems too

You don't need a full rebuild. We can add immutable logging to systems you already run, such as your app's admin actions, database changes, CI/CD deployments and cloud-console activity, as a fixed-price build.