The audit logging infrastructure SOC 2 and GDPR require. Cryptographically chained, tamper-evident, and auditor-ready. Ship in days, not months — without building it yourself.
No spam. Notify on launch only.
Chain integrity can be verified from exports — without trusting Logstone's servers. Hand an auditor the NDJSON export and they can confirm the chain independently.
Purpose-built for the compliance requirements blocking your enterprise deals.
Each event hashes into the next. Any modification breaks the chain. Tamper detection is mathematical — not a policy.
Mark fields as sensitive. On erasure request, the field values (old/new) are wiped — but the audit trail structure (action, resource, timestamp, chain hash) is preserved. GDPR Article 17 compliant without breaking your chain.
Trace related events across queues, webhooks, and background jobs using Correlation IDs. Every system actor, integration, and cron job can be attributed and linked back to the triggering event.
Generate time-bounded exports in NDJSON format. Each export includes chain hash information so auditors can independently verify log integrity — no need to trust Logstone's infrastructure.
Node.js available at launch. Python, Go, and Rust SDKs in the pipeline. Simple API — log an event in three lines.
Log autonomous AI actions with full context. Who approved it, what was decided, what model ran. EU AI Act ready.
Every event is attributed to the right actor — human users, your own system or background jobs, or third-party integrations. No more ambiguous "who made this change?"
Know exactly who did what — whether it was a human, your own backend, or a third-party integration.
Every event is attributed to exactly the right source. Stop guessing which changes came from humans vs. automation.
Use subTenantId to scope audit logs to the end-customers inside your own multi-tenant product. Each sub-tenant sees only their own trail.
Three built-in roles control access to audit logs across your team. Grant your compliance officer read-only access without touching your codebase.
Norwegian-founded, hosted within the EU. GDPR isn't an afterthought — it's the foundation. Whether you're in Europe or the US, your data stays where you need it.
import { Logstone } from '@logstone/node'; const logstone = new Logstone({ apiKey: process.env.LOGSTONE_API_KEY, }); // Log an audit event await logstone.log({ actor: { type: 'user', id: 'user_123', email: 'alice@example.com', }, action: 'user.updated', resource: { type: 'user', id: 'user_456', }, sensitiveFields: [ { field: 'email', oldValue: 'alice@old.com', newValue: 'alice@example.com' }, ], }); // Cryptographically chained // and stored in the EU.
No infrastructure to manage. No compliance expertise required. Just logs that work.
Add @logstone/node to your project. Initialise with your API key. Takes two minutes.
Call client.log() with an actor, action, and resource. Cryptographically chained and stored in the EU instantly.
Search, filter, and export logs in auditor-ready formats from the dashboard. Give your compliance team exactly what they need to pass the audit.
You could — but it typically takes 2-3 months of engineering time, and that's before you tackle cryptographic integrity, retention policies, GDPR compliance, and keeping it maintained. Logstone gives you all of that out of the box so your team can focus on your actual product.
A regular database can be modified — records can be edited or deleted without any trace. Logstone chains every event cryptographically, so any tampering is mathematically detectable. That's what auditors actually require.
All data is stored on servers within the EU. It never leaves the EU. We're GDPR-native by design.
Yes. We use pseudonymisation — we store an ID like usr_a3f9c2 in the log, not the user's email or name. You control the mapping. To erase a user, you delete the mapping on your end. The log chain stays intact.
Logstone is in early access — a limited number of teams are already using it in production. We're onboarding new customers from the waitlist. Join the waitlist to get in line for access.
Logstone is built for engineering teams at B2B SaaS companies — specifically if you're preparing for a SOC 2 or GDPR audit, if your customers ask "who made this change?", or if you have background jobs, webhooks, or integrations that mutate data and need a clear attribution trail.