Every log entry is hash-chained, HMAC-sealed, and anchored to a public timestamp authority. Any change — even to a timestamp — breaks verification, and anyone can check it independently, with no account.
# 1. Create an API key in your dashboard → API Keys
export QNTYX_KEY="qntyx_audit_…"
# 2. Create an audit stream (returns a stream id)
curl -X POST https://audit-api.qntyx.io/streams/ \
-H "Authorization: Bearer $QNTYX_KEY" -H "Content-Type: application/json" \
-d '{"name": "production-audit"}'
# 3. Append a sealed entry
curl -X POST https://audit-api.qntyx.io/entries/ \
-H "Authorization: Bearer $QNTYX_KEY" -H "Content-Type: application/json" \
-d '{"stream_id": "STREAM_ID", "actor": "user@example.com", "action": "login", "resource_type": "session", "resource_id": "abc123"}'
Ingest events via SDK, webhook, or API. Every action your system takes becomes a log entry with actor, action, resource, and metadata.
Each entry is sealed with a quantum nonce + SHA-256 hash chain + HMAC-SHA256 signature. The seal is immutable and cryptographically linked to every prior entry.
Anyone can verify any seal using our public endpoint. No account needed. Auditors verify client evidence with a single URL.
Each seal uses entropy from quantum entropy via QuantumRand — not pseudorandom generators.
Every entry cryptographically links to the previous. Tamper with one, the entire chain breaks forward.
Server-side signing with a secret key prevents client-side forgery of seals or timestamps.
The sealed_at timestamp is locked at seal time. Backdating is cryptographically detectable.
Auditors verify evidence at audit-api.qntyx.io/verify — no account, no software, no friction.
Whether you're from Deloitte, PwC, EY, or KPMG — verify any quantum-sealed audit log entry or evidence package with a single GET request. No login. No software. Just proof.