[Alternatives](/alternatives/) / DIY audit tables

# Rolling your own audit tables vs using Veritio

The default move: an \`audit\_events\` table, some triggers or middleware, \`actor\`, \`action\`, \`created\_at\`. Every team has built one. It works — until someone asks whether the history can be trusted, exported, or explained.

[See Veritio Cloud](/cloud/)[View on GitHub ↗](https://github.com/getveritio/veritio)

Apache-2.0 core · Verifies offline · Self-host or cloud

DIY audit tables

audit\_events table

Mutable rows

-   1040 · user.role.updated14:02:11
-   1041 · invoice.deleted14:02:58
-   1042 · user.readrewritten — no trace
-   1043 · user.invited14:07:44

Append-only by convention

Veritio

Evidence & verification

Evidence chain

-   session.startedrisk 0.05
-   tool.calledrisk 0.18
-   change.recordedrisk 0.34
-   deploy.completedrisk 0.41
-   approval.grantedrisk 0.12

Verify: validoffline

The same edit breaks the chain — visibly

vs

## What DIY audit tables does well

-   Zero new dependencies; lives in the database you already run.
-   Total control over schema and retention.
-   Perfectly adequate for internal debugging and light traceability.
-   No procurement, no vendor review.

## Where Veritio differs

-   Append-only by convention is not tamper-evident: anyone with a migration or DB access can rewrite history without trace. Veritio’s records are hash-linked, so any edit breaks the chain visibly.
-   A table has no export story: handing a reviewer database access is not evidence. Veritio exports open, verifiable bundles a third party can check without touching your systems.
-   Risk and structure come free: origin typing (user / service / AI agent), deterministic risk scores, and episode rollups — things a bare table grows only through years of accretion.
-   The schema, SDK, and verifier are open source — you can adopt the structure without adopting a vendor.

## Side-by-side comparison

Capability

DIY audit tables

Veritio

Time to first row

An afternoon

An afternoon (npm install @veritio/core)

Tamper evidence

By convention only

Hash-linked chain

Independent verification

—

Open verifier + export bundles

AI agent modeling

Roll your own

Sessions, tool calls, episodes built in

Risk scoring

Roll your own

Deterministic policy, 0–1 per event

Long-term cost

Accretes ad hoc

Maintained open protocol

Comparison last reviewed August 2026. Products change — check vendor documentation for current behavior. Veritio provides evidence support for reviews and investigations, not automatic compliance.

## Choose DIY audit tables when…

You need light internal traceability, your reviewers are your own engineers, and nobody will ever ask for proof that history was not rewritten. A plain table is genuinely fine for that.

## Choose Veritio when…

Someone — a customer, an auditor, a future you during an incident — will eventually ask "can you prove this happened as recorded?" Retrofitting tamper evidence onto years of mutable rows is much harder than starting with a chain.

## Stronger together

Keep your table for debugging. Add a chain for the day someone asks for proof.

[See Veritio Cloud](/cloud/)[View on GitHub ↗](https://github.com/getveritio/veritio)[More comparisons](/alternatives/)