Audit Trail
An event ledger that no one can alter after the fact. Every entry is sealed with a qualified eIDAS timestamp — court-admissible across the entire EU.
When the regulator asks what happened at 14:32 on March 3rd, your answer needs to be tamper-proof. Not a screenshot. Not a database export someone could have edited. A cryptographic proof.
14-day free trial · no credit card required
When you will be glad you had this
Three moments where a tamper-proof record makes the difference.
The regulator calls
DORA incident investigation. The supervisory authority wants to know exactly which systems were accessed, by whom, and in what order — in the 48 hours before the outage.
You export the audit ZIP. Every event is timestamped and cryptographically sealed. Nothing is reconstructed from memory.
The lawyer needs proof
A contract dispute. The other party claims your system processed their data after they revoked consent. You say it did not.
Your audit trail has a cryptographic proof for every data access event. A court can verify it offline, independently.
The auditor arrives
Annual GDPR audit. The auditor asks for records of who accessed personal data in the last 12 months — and whether those records could have been modified afterward.
You hand over a self-contained ZIP. The auditor runs VERIFY.md. Done — no TrustBeat account needed.
How it works
Four steps from your event to an irrefutable record.
Submit any event
Call tb.audit.log() with actor, action, resource, and any metadata you need. Returns in milliseconds — 202 Accepted, never blocks your application.
Works with user actions, system events, data access, approvals, configuration changes — anything.
Content is hashed, not stored raw
The full event JSON is canonically hashed with RFC 8785 JCS. Only the hash is anchored unless you submit the structured event payload — your raw data stays in your system.
This makes the audit trail GDPR-safe by design. You control what content you submit.
Sealed every 10 minutes
Events are batched into a Merkle tree and anchored with a qualified eIDAS timestamp from an EU Trusted List QTSP. Automatic — nothing to configure.
One qualified timestamp covers thousands of events. Cost stays low regardless of event volume.
Per-event inclusion proof — forever
Each event gets its own Merkle path to the qualified timestamp. You can verify it offline with standard OpenSSL tools, today or in 30 years.
Proofs are self-contained. No TrustBeat service dependency for verification, ever.
RFC 8785 (JCS) · RFC 3161 (TSA) · eIDAS Art. 41 legal presumption
Regulatory coverage
Each regulation mandates tamper-evident records in a different context. One audit trail covers them all.
| Regulation | Article | Covered |
|---|---|---|
| DORA | Art. 17 | |
| DORA | Art. 25 | |
| MiFID II | Art. 16(7) | |
| GDPR | Art. 5(2) | |
| GDPR | Art. 30 | |
| NIS2 | Art. 21 |
Not seeing your regulation? Email us — we will map it for you.
Log your first event in five lines
Five zero-dependency SDKs. One call. An eIDAS-sealed record in your next 10-minute batch.
$ npm install trustbeatimport { TrustBeatClient } from "trustbeat";
const tb = new TrustBeatClient("YOUR_API_KEY");
const { eventId } = await tb.audit.log({
actor: "user:42", action: "data_export", resource: "report:Q4-2025",
});
console.log(eventId); // → 01JQ...Common questions
Does the auditor need a TrustBeat account to verify the export?
No. The audit ZIP export contains a VERIFY.md with step-by-step instructions using standard OpenSSL commands. Any auditor can verify every event and its proof independently — no TrustBeat account, no third-party dependency required.
Is my event content stored on TrustBeat servers?
Only if you submit it via the structured event endpoint. The minimum required to anchor an event is a SHA-256 hash — in that case, raw content never leaves your system. If you submit the full event payload, it is stored for the retention period of your plan tier.
What happens if TrustBeat shuts down — can we still verify old proofs?
Yes. Every proof is a self-contained cryptographic bundle: a Merkle path plus a qualified eIDAS timestamp token (RFC 3161 DER) issued by an independent EU Trusted List QTSP. These can be verified offline with standard OpenSSL tools — no TrustBeat service involved.
Is the timestamp legally valid across EU member states?
Yes. Under eIDAS Regulation Art. 41, a qualified electronic timestamp has legal effect in all EU member states — Germany, France, Czech Republic, everywhere in the EU. The QTSP issuing the timestamp is listed on the national EU Trusted Lists maintained by each member state.
Can I search and filter my events after the fact?
Yes. Events are indexed by actor, action, resource, and timestamp. You can search and filter through the portal UI or via the API. Full history is available for the retention period of your plan.
Prêt à ancrer votre premier document ?
Commencez gratuitement. Sans carte de crédit. Les 100 premiers hashes sont offerts.
eIDAS Regulation (EU) No 910/2014 · Art. 41 legal presumption · EU Trusted List QTSP