Open-source. Self-hosted. Compliance by design.

View on GitHub ↗
Open-source evidence layer

Who did what, how risky it was, and proof it happened.

Veritio records application events, agent sessions, code changes, and deployments as hash-linked audit events — with origin and a deterministic risk score on every step — that anyone can independently verify and export. Evidence support for reviews and investigations, not automatic compliance.

View on GitHub ↗See examples
Veritio Cloud console in dark mode: the Operations dashboard with an evidence stream of hash-linked tool calls, code changes, and deploys, each with a risk score, above a critical episode's risk timeline.

Veritio Cloud · Operations console — captured from a reference deployment running @veritio/core risk scoring under policy veritio.reference.v1. Demonstration data.

Software ships itself now.

An agent writes the migration. A pipeline approves it. A service deploys it to production at three in the morning. The work is real — and so are the questions that follow it: who did this, under whose review, and how dangerous was it?

Application logs weren't built to answer. They rotate, they get rewritten, and they belong to whoever holds the database. Veritio turns each action into a record instead: an origin — user, service, or AI agent — a deterministic risk score, and a hash that locks it into sequence. Evidence, not logs.

Anatomy of a record.

This is the fourth record from the recording above — the production table drop — exactly as an SDK stores it. Hashes truncated for print.

record #4 · deploy.deployedjson
{
  01"sequence": 4,
  "previousHash": "5db8…",
  02"hash": "c1a7…",
  "hashAlgorithm": "sha256",
  "canonicalization": "veritio-json-v1",
  "appendedAt": "2026-06-23T00:03:00.412Z",
  03"event": {
    "id": "evt_9f27a1c4",
    "occurredAt": "2026-06-23T00:03:00.000Z",
    "action": "deploy.deployed",
    "actor": {
      "type": "service",
      "id": "svc_deploy"
    },
    "target": {
      "type": "deployment",
      "id": "dep_0623"
    },
    "scope": {
      "tenantId": "org_acme",
      "environment": "production"
    },
    "metadata": {
      "activityEpisodeId": "ep_7c21f0a3",
      04"riskSignals": {
        "operationType": "destructive",
        "reversibility": "irreversible",
        "envCriticality": "production",
        "dataVolume": 12000,
        "fanOut": 12,
        "referenceCount": 12
      }
    }
  }
}
  1. 01

    sequence · previousHash

    Each record locks to the one before it, per tenant. Delete or reorder history and the chain stops verifying at exactly that point.

  2. 02

    hash · canonicalization

    SHA-256 over canonical bytes (veritio-json-v1). Change one character anywhere in the record and this stops matching.

  3. 03

    event

    The protocol body: who (actor.type — user, service, or ai_agent), what (action, target), and where (tenant scope). Same field names in TypeScript, Python, and Go.

  4. 04

    metadata.riskSignals

    The inputs behind the score in the recording above. The policy is open — recompute the score yourself and you get the same number.

Hover a note — or the record — to cross-highlight

Edit one byte. The chain notices.

An audit trail is only as good as its answer to one question: how do I know nobody touched it?

Veritio's answer is arithmetic, not access control. The verifier re-derives every hash from the canonical bytes and walks the chain, so mutation, deletion, and reordering all surface — with the exact position where history diverged.

And because the verifier ships in the open packages, an auditor doesn't have to trust your database, your admins, or us.

verify.tsts
import { verifyAuditRecords } from "@veritio/core";

verifyAuditRecords(records);
// → { ok: true }

// Quietly promote someone in an old record:
records[2].event.metadata.role = "admin";

verifyAuditRecords(records);
// → { ok: false, index: 2, reason: "hash_mismatch" }

// Try deleting the record instead:
const gapped = records.filter((_, i) => i !== 2);

verifyAuditRecords(gapped);
// → { ok: false, index: 2, reason: "sequence_mismatch" }

Start in your own stack.

Install the SDK, create an audit event, append it to a store. The in-memory store runs anywhere, so you can record and verify evidence before you wire up durable storage.

audit-event.tsts
import { MemoryAuditStore, createAuditEvent } from "@veritio/core";

const store = new MemoryAuditStore();

const event = createAuditEvent({
  id: "evt_01",
  occurredAt: "2026-06-10T00:00:00.000Z",
  actor: { type: "user", id: "usr_123" },
  action: "org.member.invited",
  target: { type: "organization", id: "org_123" },
  scope: { tenantId: "org_123", environment: "production" },
  purpose: "access_management",
  lawfulBasis: "contract",
  retention: "security_1y",
  metadata: { inviteId: "inv_123", role: "viewer" },
});

await store.append(event);

In the box

SDKs
@veritio/core (TypeScript) · veritio (Python) · Go
Adapters
Better Auth, Next.js, TanStack Start, SvelteKit · UI intent helpers for React, Vue, Svelte
Storage
PostgreSQL/Neon, MySQL, MariaDB, MongoDB · Redis tip cache
Schemas
Audit events, evidence graph edges, export bundle format
Verifier
Chain verification in every SDK — re-runnable by auditors
Workbench
veritio dev --mcp: local evidence graph, scenario runner, MCP tools
View on GitHub ↗See examples

Or let us run it.

Veritio Cloud is the managed way to run the same open protocol: we operate ingest, storage, retention, and exports — you keep evidence that anyone can verify without trusting us. The open-source path always works on its own; Cloud is for teams that would rather buy the operations than staff them.

Create an account ↗See pricing →Talk to us
  • ·Managed ingest and durable retention
  • ·A shared evidence graph across services
  • ·Exports and verification on demand
  • ·Team access and operational support
Veritio Cloud episode canvas: a critical activity episode's events — security risk, tool calls, a code change, and a deployment — laid out as connected cards, with the episode's critical-risk rollup in the corner.

The same records on Veritio Cloud's episode canvas — scores and chain, tracked visually instead of as a list. Demonstration data.