Don’t take our word for it. Check it.
Below is a real audit export from a governed run. Press the button and your browser re-derives every hash and re-checks every Ed25519 signature, on your machine, with nothing sent anywhere. Then break it on purpose and watch it fail.
No network calls · nothing leaves this page
Every entry is hash linked
Each event carries a SHA-256 of its own contents plus the hash before it, all the way back to a fixed genesis value. Change one character in one event and that link stops matching.
Every entry is signed
The runtime Ed25519-signs each entry hash with a key that never enters the sandbox. A rewritten event can be re-hashed, but it cannot be re-signed without the private key.
The set itself is signed
A signed manifest commits to the exact membership of the export. That is what catches a deleted or truncated event, which hash linking alone cannot see.
This is the same check our offline verifier runs, and the same one your auditor can run without us. The run above is a sample signed with a demo key so anyone can test it. A real export from your own tenant verifies identically, against your own signing key.