Guides on audit evidence, AI records and compliance.
Written by the people who build Invoance. Practical material for engineers, compliance leads and finance teams who have to show their work.
AI Agents Can Delete Their Own Traces. Sign the Record Somewhere Else.
Researchers got coding agents to delete their own session logs with a direct request, a planted skill file, and a scoring rule that rewarded shorter traces. The usual fix moves the log somewhere else. This guide goes further: the gateway signs every action, the proxy attests every model exchange, approvals are bound to one exact call, and a deleted row shows up as a gap.
ReadPasskeys on the Invoance Dashboard: Phishing-Resistant Sign-In With One Touch
You can now sign in to Invoance with a passkey instead of a password. One touch proves the device and the person holding it, the key only answers to invoance.com, and your password stays as the way back in. Here is how it works and how to set it up.
ReadSign In With Microsoft Is Live. Here Is How We Built It Safely.
Continue with Microsoft is on the Invoance sign-in and sign-up pages. No new password, a work email verified by your own tenant, and the same two-factor step as every other sign-in. The interesting part is the three decisions underneath: match on tenant and object id, never trust the email claim on its own, and never let one identity provider become a way around the other controls.
ReadOpenAI Is Watermarking Text in the EU. A Watermark Is Not Proof.
OpenAI announced text watermarking for ChatGPT and Codex in the EU, and was unusually direct about the limits: short passages often go undetected, rewriting or translating removes the mark, and the detector is not public. A watermark guesses whether text came from a model. Proof records which model, which input, which output, when, and lets anyone check. They answer different questions, and the second one is the one your auditor asks.
ReadHow to Give a Long-Running AI Agent a Verifiable Trace
An agent that runs for hours leaves a long trail of model calls, tool invocations, and side effects. Application logs record that trail; they cannot prove it was not edited afterward. Here is how to give every agent run a signed, sealed, independently verifiable trace with Invoance: create, attest, anchor, seal.
ReadInvoance Audit Logs vs WorkOS Audit Logs: An Honest Comparison
Both products record who did what in your customers' accounts, and both ship a portal, streaming, and exports. The fork in the road is what happens after an event is stored: WorkOS asks your customer to trust the record, Invoance signs it so they can check. A feature-by-feature and price-by-price comparison, with sources.
ReadWorkOS Audit Logs Alternatives: A Buyer's Guide
Most WorkOS alternatives lists are identity-platform roundups where audit logs are one checkbox among twenty. If what you actually need is the audit log, the field looks different. Here is how to pick by the job you are hiring for, what each path costs, and the one question that separates audit log products fastest: can anyone verify the record?
ReadThe Invoance Audit Viewer Is Now a React Component You Can Embed
The audit log page your enterprise customers keep asking for is now a drop-in React component. @invoance/audit-viewer is the exact package our hosted portal mounts: signed event table, filters, CSV/JSON export, live refresh, and signature verification that runs in your customer's browser. Here is what shipped and how to embed it.
ReadReasons and Best Practices for Using Audit Logs in Your Application
Audit logs answer a question your regular application logs cannot: who did what, when, and can you prove it. This guide covers the real reasons teams add audit logging and the best practices that separate a trustworthy audit trail from a pile of unverifiable text.
ReadOfficial Invoance SDKs, Now in Eight Languages
The Invoance client libraries now cover eight languages. Every SDK anchors events, documents, and AI outputs to an append-only ledger, signs them with your tenant's Ed25519 key, and verifies signatures entirely client-side — so the proof holds up whether or not anyone trusts Invoance. Here is what shipped and how to start.
ReadHow to Export Audit Logs for Enterprise Customers: Signed, Verifiable, Audit-Ready
Any system can dump audit logs to a CSV. The problem is that a CSV is a file you are asking an auditor to trust. This guide shows how to export audit logs as signed, independently verifiable records: paginated from a real API, with a per-record Ed25519 signature and a gapless sequence that proves nothing was dropped or altered.
ReadHow to Tell If a PDF Has Been Edited or Backdated (And How to Actually Prove It Wasn't)
A PDF's Created and Modified dates are just editable text, and a clean re-save erases the very traces forensics looks for. You cannot reliably detect tampering or backdating after the fact. Here is why, and how to prove a document is unchanged with a hash, a signature, and a timestamp its author never controlled.
ReadHow to Build Audit Logs for a SaaS App: The Complete Engineering Guide
Most SaaS audit logs are just an events table with a timestamp, and they fall apart the moment someone has a reason to doubt them. This guide shows how to build audit logs that hold up: the schema, append-only storage, idempotent ingest, retention, and the tamper-evidence and verification layer that turns a log into evidence. Then where the build-versus-buy line actually is.
ReadHow to Prove Your AI Did What It Said: A Developer's Guide to Verifiable AI Outputs
Your AI's output is gone the moment it returns. Logs aren't proof. This guide shows how to attach a cryptographic receipt to every model call, in three lines of code, with a public URL anyone can verify, no Invoance account required.
ReadIntroducing Document Anchor: Cryptographic Proof That a Document Existed, Unchanged, at a Specific Moment
Contracts get disputed. Filings get questioned. Wire instructions get spoofed. Document Anchor replaces 'trust our DMS' with cryptographic proof anyone can verify, and breaks the BEC playbook in the process.
ReadTraces: Verifiable Process Proof, What It Is and How It Works
Individual event proofs answer 'did this happen?' A trace answers 'here is everything that happened during this entire process, in order, cryptographically proven.' Traces turn multi-step business processes into exportable, independently verifiable proof artifacts.
ReadEvent Ledger: Immutable Compliance Records for Business Events
Logs can be edited. Databases can be modified. The Event Ledger is different, every event is hashed with SHA-256, signed with Ed25519, and stored in an append-only ledger that cannot be altered after ingestion.
ReadAI Attestation: What It Is, Why It Matters, and How to Implement It
AI systems make decisions that affect loans, diagnoses, hiring, and contracts. When those decisions are challenged, organizations need proof of what the model produced, when, and with what inputs. AI attestation provides that proof.
ReadTrust Infrastructure: What Compliance Automation Cannot Prove
Compliance automation tells auditors what controls you have. Trust infrastructure proves what actually happened. As regulatory scrutiny intensifies and AI systems scale, the gap between documenting controls and proving outcomes is becoming the most expensive blind spot in enterprise security.
ReadSOC 2 Compliance: The Complete Guide for Modern Organizations
SOC 2 has become the baseline trust standard for SaaS companies and service providers. This guide covers the trust service criteria, audit types, preparation strategies, and how verifiable evidence closes the gap between controls and proof.
ReadBuilding Trust: The Complete Guide for Digital Organizations
Trust is the invisible infrastructure of every business relationship. This guide breaks down what trust actually means in digital organizations, why it erodes, and how to build verifiable trust through transparency, security, and cryptographic proof.
ReadDocument Anchoring: Cryptographic Proof for Business Records
Every business depends on documents, contracts, invoices, certificates, audit reports. Document anchoring creates cryptographic proof that a specific document existed in a specific form at a specific time, without relying on the integrity of any single system.
ReadHIPAA Compliance: The Guide for Technology Organizations
HIPAA governs how protected health information is handled across healthcare and technology. This guide covers what technology organizations need to know about HIPAA requirements, common pitfalls, and how verifiable evidence strengthens compliance posture.
ReadThird-Party Risk Management (TPRM): Implementation Guide
Third-party risk management has evolved from annual vendor questionnaires to continuous evidence-based assurance. This guide covers how to build a TPRM program that actually reduces risk, not just documents it.
ReadGRC: How to Implement Governance, Risk, and Compliance with Ease
GRC brings governance, risk management, and compliance together into a unified discipline. This guide covers how to implement a practical GRC program that avoids bureaucratic overhead while delivering measurable risk reduction.
ReadISO 42001 Compliance: What Engineering Teams Need to Know
ISO 42001 is the first international standard for AI management systems. For engineering teams, it means specific technical requirements around auditability, traceability, and governance. Here is what you actually need to build.
ReadISO 27001: The Complete Guide to Certification
ISO 27001 is the international gold standard for information security management. This guide covers the ISMS framework, Annex A controls, certification process, and how verifiable evidence strengthens your security posture beyond checkbox compliance.
ReadGDPR Compliance: The Guide for Technology Organizations
GDPR transformed how organizations handle personal data. This guide covers the key principles, practical obligations, common pitfalls, and how cryptographic proof infrastructure helps satisfy the accountability principle that underpins the entire regulation.
ReadCMMC: The Guide to Cybersecurity Maturity Model Certification
CMMC is mandatory for organizations in the defense industrial base. This guide covers the three certification levels, how to prepare for assessment, and how verifiable evidence infrastructure strengthens CUI protection.
ReadCyber Essentials: The Guide to UK Cybersecurity Certification
Cyber Essentials is the UK government-backed scheme that protects organizations against the most common cyber attacks. This guide covers what you need to know about certification, the five technical controls, and how to achieve it efficiently.
ReadWhy Traditional Audit Logs Fail Under Regulatory Scrutiny
Your application logs record what happened. But in an audit or legal proceeding, the first question is not what your logs say, it is whether anyone can trust your logs. Traditional logging has a fundamental integrity problem that most teams do not address until it is too late.
ReadHITRUST: The Guide to HITRUST CSF Certification
HITRUST CSF is the most comprehensive security framework for healthcare and technology organizations. This guide covers the framework architecture, assessment types, and how to navigate the certification process efficiently.
ReadFedRAMP: The Guide to Federal Cloud Compliance
FedRAMP is the mandatory security standard for cloud services used by US federal agencies. This guide covers the authorization process, impact levels, control requirements, and how to navigate the path to FedRAMP compliance.
ReadRisk Management: The Complete Guide for Modern Organizations
Risk management is the discipline that separates organizations that survive disruption from those that do not. This guide covers how to identify, assess, treat, and monitor risks systematically, and why verifiable evidence is the missing layer in most risk programs.
Read