Chronicle

#What it is

Chronicle is an immutable audit trail. Every event is linked to the one before it by SHA-256, so editing or deleting an event breaks the chain and shows up in verification.

It does not prevent tampering, since nothing prevents someone with database access from writing to the database. It makes tampering detectable, which is the property auditors are actually asking about.

#GDPR without breaking the chain

An append-only hash-linked log and a right to erasure are not compatible in their naive forms. Chronicle resolves it with per-subject AES-256-GCM encryption: personal data in an event is ciphertext under a key belonging to that data subject, and the key lives outside the log.

Destroy the key and the ciphertext stays exactly where it is with its hash unchanged, so the chain still verifies end to end, while the plaintext is unrecoverable.

You delete the key, not the record.

The catch is that key management becomes the whole problem, including backups of the key store, and that a key vault with a thirty-day soft-delete window quietly invalidates the claim.

#What else it does

• Multi-tenant scoping from context, so cross-tenant queries are impossible rather than filtered.
• Compliance reports for SOC 2 Type II, HIPAA, the EU AI Act and custom frameworks, exported to JSON, CSV, Markdown or HTML.
• Pluggable stores: Postgres via pgx, Grove, SQLite, Redis as a cache layer, memory for tests.
• Pluggable sinks for fire-and-forget outputs (stdout, file, S3, custom) that never block the pipeline.
• Retention policies with scheduled archival and purge.
• 21 admin endpoints covering events, verification, erasure, retention, compliance and stats.

#The design constraint

An audit event has a fixed shape: actor, action, resource, outcome, scope, timestamp. Every request to add a free-form field has been refused. That is why a compliance report is a query rather than a text-mining project.