We audit ourselves

AuditKit writes its own platform events (sign-ups, log-ins and log-outs, project, API key, viewer token and tenant key changes, tenant policy changes, OAuth consent and denial, customer erasure, billing events, demo resets, retention runs and service starts) to a system project that is hash-chained and anchored like any customer's. People appear only as hashed handles such as u:3f9a…; we never log email addresses, and payloads carry ids and hashes, not personal data. We do not log your customers' events here, your event payloads, or anything inside your projects.

Why this matters: if we don't trust our own product with our own trail, you shouldn't either.

curl -o auditkit-platform.ndjson /public/self/export
node packages/verify/dist/cli.js auditkit-platform.ndjson

Read-only and public: GET /public/self/events, /public/self/events/:id/proof, /public/self/verify, /public/self/export. How the chain and anchors work is on /security and /anchors.