A record you can hand over
Hash-chained, exportable, and clear about what it proves. An auditor asks "how do you know?" The answer should be a command, not a slide.
4 records · chained · not yet verified
CEF:0|Kodela|Kodela|1|egress|egress decision|5|rt=2026-09-28T09:14:06Z suser=acme/dev01 dhost=cdn.example.com act=deny cs1Label=org cs1=acme
One event, five formats. Field names are illustrative. Export is on demand: you ship the file; nothing pushes to your SIEM.
What happens on your host, written down
Kodela writes what happens to an append-only, hash-chained audit trail on your host: identity, workspaces, policy changes, git, egress, model use and detections.
Each record carries the one before it
Every record stores the SHA-256 of the previous record plus its own payload. Change one line and every hash after it stops matching. audit-log verify walks the chain and names the stream and line of any break.
Limit: tamper-evident, not tamper-proof against the host's root user. Ship the export off the host if that matters to you.
Redacted before it is written
Credentials are redacted before a record is written, so the trail itself does not become the leak. The auditor role is strictly read-only. The audit is kept on host disk for 90 days by default, a setting that can only be raised, and it is included in bin/backup.
$ bin/audit-log verify
egress ok 1,204 records
git ok 86 records
policy BROKEN at line 212The organisation's own view
The organisation's Audit tab (owners, admins and auditors) is a dashboard: a timeline by day, refused counts, sections by question, an integrity panel, and an export of the current filter that is itself audited. Up to 90 days, never past your retention; it shows only records provably the organisation's own.
- Sections by question: People & access, AI activity, Code & provenance, Network, and Workspaces & settings. Every record is written as a sentence.
- Refused and would-be-refused counts filter the view with one click. Open a record to see how it happened: authorship, agent run, approver and model.
- The integrity panel says whether the audit log's hash chain verifies and how many of the organisation's pushes carry a verified signature, or that the check did not report.
- Export sends exactly the current filter as CSV or JSON, defused for spreadsheets, and the export is itself recorded. The host-wide HTTP export stays operator-only.
- Sign-ins. Password and shared-credential sign-ins are recorded from orxy V1.7.2.2 on (single sign-on sign-ins are recorded as 'signed in with SSO'); earlier sign-ins are not in the trail. The password is never recorded, and an address that is not an account never appears in an organisation's audit.
- AI usage. An AI usage tab for organisation admins and auditors: requests, tokens and cost by member, workspace, surface, model and account. There is no spend cap; cost shows only where the cost meter is on; AI tools that hold their own login inside a workspace are not measured.
Limit: records that only carry the organisation's name, with no proof they belong to it, are withheld, and the screen says how many and why. A plain member is not offered the Audit tab.
Know which controls are NOT MET before the auditor does
An evidence report scores the platform's live configuration against ISO 27001, SOC 2 and NIST 800-53 controls. It is evidence, not a certificate.
Before an audit
bin/compliance-report --framework soc2 --html- Fix the NOT MET controls.
- Re-run the report.
- Attach the HTML and the
audit-log verifyoutput to the evidence request.
What ships, what it defaults to, where it stops
Splunk, QRadar, ArcSight and Sentinel read the export formats. You ship the file.
| Capability | Default | Limit |
|---|---|---|
| Hash-chained audit | on | Tamper-evident, not tamper-proof against host root |
| Streams: git, egress, model, keys, policy, detection, workspace, identity | on | n/a |
| Export: CEF, LEEF, syslog, JSON, CSV | on demand | Export only; nothing pushes to your SIEM. The host-wide HTTP export is operator-only; an organisation's Audit tab exports its current filter as CSV or JSON, and that export is audited |
| Retention | 90 days for audit | Raise-only |
| Organisation Audit tab: timeline by day, refused counts, five sections, integrity panel, export | on for owners, admins and auditors | Up to 90 days, never past retention; shows only records provably the organisation's own |
| Sign-in records (password and shared-credential) | on | From orxy V1.7.2.2 on; single sign-on sign-ins are recorded as "signed in with SSO"; a flood becomes one record a minute with a count |
| AI usage tab | on for admins and auditors | No spend cap; cost only where the cost meter is on; AI tools holding their own login in a workspace are not measured |
| Compliance evidence report (ISO 27001:2022, SOC 2 TSC, NIST 800-53 r5) | on demand | Evidence, not certification; no EU AI Act, GDPR or HIPAA mapping |
| Organisation posture audit | on demand | Lists organisations looser than the floor |
| SBOM (CycloneDX) and signed manifest | on demand | The image layer needs syft; no image signing |
Questions
Is Kodela SOC 2 certified?
No. It produces evidence you can use in your own audit.
Who can see an organisation's audit?
Its owners, admins and auditors, and platform operators. A plain member is not offered the Audit tab. The view shows only records provably the organisation's own, and no secret value, because records are redacted before they are written.
Can we stream to our SIEM?
Export today. You schedule the shipping; built-in forwarding is not built.
Is the audit log tamper-proof?
It is tamper-evident: a hash chain that names the line where it breaks. The host's root user could rewrite it, so ship the export off the host if that matters to you.
Does it make us EU AI Act compliant?
No product can do that for you. The authorship record and audit trail are records you may find useful.
What it does not do yet
- Built-in forwarding to a SIEM. You ship the exported file.
- Protection against the host's root user.
- Mappings for the EU AI Act, GDPR, HIPAA or DORA.
- Image signing or a CVE image scan. The SBOM is incomplete without syft.
- Certification. None is held and none is in progress.
- Sign-ins from before orxy V1.7.2.2. They were not recorded.
- An audit window past 90 days in the organisation's dashboard, or past your retention.
Hand over a command, not a slide
See how the evidence report and the verify output fit an audit.