Don’t trust the audit log. Check it.
The verifier ships to you and runs on your systems. Your team can re-derive the entries present, see whether a signed checkpoint covers the tail, and read the limits of what that result proves.
The record, re-derived on your machine
redactwall verify-audit-chain reports one of four results: verified intact, broken at sequence N, could not verify, or verified, tail uncovered. A run with an uncovered tail says so, rather than reporting a plain success.
Example audit chain verified.
$ redactwall verify-audit-chain --plane tenant --anchor /var/lib/redactwall/anchor
verify-audit-chain: plane tenant, tenant ten_a1a1a1a1a1a1a1a1a1a1a1a1
verify-audit-chain: head sequence 3, key version 1
verify-audit-chain: head digest sha256:e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4e4
verify-audit-chain: walked 3 entries through sequence 3
verify-audit-chain: signed checkpoint at sequence 3 matches this chain's entry there
verify-audit-chain: VERIFIED - every entry from 1 to 3 re-derived under its own key and MAC domain, and every link digest matched its predecessor.
Example output, reproduced in the format the commands print. The identifiers and digests are examples, not values from any deployment.
The platform identity chain, with its two disclosures
The second chain is the platform identity chain: the record of who was provisioned and what was enrolled. Every run against it that reads a checkpoint prints two disclosures.
This chain’s checkpoint is periodic, so entries added after it are covered by no checkpoint until the next one is published.
Its binding to the database in front of you is declared by the operator, not attested by the product.
A verifier that printed only good news would be marketing. These two lines print on every such run because they are true on every such run.
Sealed, then checkable anywhere
Export
Period-scoped and signed
redactwall export-examination-package produces a signed bundle for a stated reporting window. Its manifest names that window, and the standalone verifier checks the packaged entries and signatures. The result does not prove that every event was recorded.
Verify anywhere
No database. No configuration. No key of ours.
redactwall verify-examination-package checks a bundle standalone. A third party can validate what they were handed without access to any RedactWall system, ours or yours.
There is something real for it to check
Decisions on governed paths land on a linked record. Changing or reordering an entry makes verification fail; a signed checkpoint also exposes removal of entries it covered, while an uncovered newest tail is reported plainly. The check does not prove every event was recorded.
Run it on your own systems
Work with RedactWall to confirm fit, agree the scope and verify one managed device before expanding.
- Checks the entries present in the record
- Signed checkpoints expose covered tail removal
- The report states what the check does not prove