Agent-FirstAgent-first adaptive
audit trails.
Log complex autonomous agent loops, prompt variations, and tool execution paths side-by-side with your traditional microservices, legacy API events, and human operator actions. One unified ledger for non-deterministic AI and deterministic apps.
9f2c-482a-a912-88fb· user_alice@acme.com · agent_finance_ops_v3Every event above is cryptographically sealed by Volidator before it leaves your server
Built For
Teams building autonomous features.
Track traditional application events, human interventions, and autonomous AI loops in one unified ledger. Volidator gives you the cryptographic proof.
AI Automation Platforms
Log every tool call, chain invocation, and subagent spawn in your LangGraph, AutoGen, or CrewAI workflows. Full execution trace per agent run.
LangChain · AutoGen · CrewAIAgentic Fintech
Immutable audit trail for AI-driven payments, credit decisions, transfers, and fraud actions. Required for FCA, SEC, and FinCEN regulatory audits.
FCA · SEC · FinCENHealthcare AI
HIPAA-compliant logging for AI diagnostics, clinical decision support, and patient data access. Zero plaintext stored on Volidator servers.
HIPAA · FDA 21 CFR 11SaaS Compliance Teams
Give enterprise customers a verifiable audit log on day one. Embed it in your product with one iframe tag. No additional backend work required.
SOC2 · ISO 27001The Build vs Buy Math
The compliance cost of homegrown audit logs.
Building a compliant log engine takes months of database planning, KMS setup, and frontend design. Maintaining it is an everlasting task. Failing an audit takes seconds.
Writing millions of high-frequency audit events directly to your core PostgreSQL or MySQL database chokes application API performance and triggers disk limit alarms.
Ingest events asynchronously via ultra-low latency edge isolates in under 5ms. Volidator indexes transactional hot data inside high-performance, real-time distributed storage layers and handles long-term compliance storage inside cold-tier analytical block storage—completely decoupled from your primary production databases.
Storing raw user emails, system prompts, IP addresses, or patient identifiers in cleartext database logs makes your logging infrastructure an instant liability for SOC 2, GDPR, and HIPAA audits.
Volidator SDK executes zero-knowledge AES-256-GCM encryption and blind hashing locally on your server before dispatch. Volidator databases only hold ciphertext. Raw PII and AI prompts never leak.
Frontend teams spend weeks coding paginated tables, search bars, filters, export systems, and secure read-only portals for external CPAs, B2B customers, and AI compliance reviewers.
Generate scoped, cryptographically signed Embed Tokens via one backend API handshake. Mount the complete, interactive audit log layout directly in your product using a zero-trust iframe framework. Decryption occurs entirely client-side inside your customer's browser window using the WebCrypto API. Plaintext data remains completely decoupled from external servers.
Live Audit Trail
Every AI action logged.
In real time.
Every AI tool call, agent escalation, prompt execution, and model decision is captured automatically. Filter by agent, action type, or date. Flag anomalous events for compliance review. Forward to your SIEM in real time.
Privacy Architecture
Breach-proof by architecture,
not by policy.
This is client-side encryption with server-blind storage, not a marketing claim. Your encryption key never reaches our servers. A full database breach exposes only ciphertext. There is nothing readable to steal.
Your SDK encrypts
AES-256-GCM encryption runs on your server. HMAC-SHA-256 blind indexes are computed for actor and action. Plaintext, including AI prompts, never leaves your process.
Edge ingestion in <5ms
The encrypted payload hits a Cloudflare Worker at the edge. Your API key is validated via a 3-layer pipeline. A 202 is returned before any write completes.
Server-blind storage
Volidator storage clusters handle only deterministic HMAC blind search indexes and AES-256-GCM encrypted cipher text vectors. No raw strings, no human-readable metrics, no cleartext prompt sequences. Our infrastructure cannot leak what it never has the key to read.
In-browser decryption
Your clients' browsers request the ciphertext streams and execute decryption operations completely locally. The ephemeral decryption credentials are kept strictly in-memory during active sessions, guaranteeing total zero-trust validation isolated entirely from both our infrastructure and transit intercepts.
Ingestion Flow
SDK Guide
First log in
under 5 minutes.
@volidator/node is a zero-dependency TypeScript package. Works anywhere Node 18+ runs: Express, Fastify, Next.js API routes, Lambda, Workers. Includes a dedicated AI Agent Auditing tab for LLM observability.
Capabilities
@volidator/node• Edge & Serverless native
• WebCrypto local encryption
• Pre-flight client redaction
• Async non-blocking ingestion
# Install via your package manager npm install @volidator/node # or pnpm pnpm add @volidator/node # or yarn yarn add @volidator/node
VOLIDATOR_API_KEYrequiredval_live_<20-hex><6-crc32>
Bearer token for the Ingestion Worker. Structurally validated via CRC32 checksum before any crypto or I/O.
VOLIDATOR_ENCRYPTION_KEYrequiredany string (min 32 chars)
Symmetric AES-256-GCM key. Derived via SHA-256. Also passed as the URL hash fragment for browser-side decryption. Never stored by Volidator.
VOLIDATOR_PROJECT_IDoptionalprj_live_<hex>
Required only for generateEmbedToken(). Embedded in the HS256 JWT as the pid claim.
VOLIDATOR_CLIENT_SECREToptionalany secret string
Required only for generateEmbedToken(). Used to sign and verify HS256 JWTs for the embeddable widget.
Quickstart
Five steps to your first event.
From zero to a working, encrypted, queryable audit trail. Including AI agent logging.
npm i @volidator/nodeZero-dependency TypeScript package. Works on Node 18+, Edge, Lambda, and Workers.
new VolidatorClient({ apiKey, encryptionKey })One-time setup. Your encryption key never leaves your server.
redactKeys: ['actor', 'metadata.email']List fields containing PII or PHI. Volidator scrubs them before encryption, no AI processing involved.
await volidator.log({ actor, action, target })One call. Encrypted at source, stored in Cloudflare D1, dispatched to your SIEM.
<iframe src={embedUrl} />Drop a scoped, decrypting audit widget into your UI. Your customers see their own logs.
import { VolidatorClient } from "@volidator/node"; const volidator = new VolidatorClient({ apiKey: process.env.VOLIDATOR_API_KEY!, encryptionKey: process.env.VOLIDATOR_ENCRYPTION_KEY!, redactKeys: ["actor", "metadata.email"], // optional PII scrubbing }); // That's it, call this anywhere in your app: await volidator.log({ actor: req.user.id, // e.g. "usr_alice" action: "EXPORT_DATA", target: "report_2026_Q2.pdf", req, // auto-extracts IP, user-agent, geo });
Every autonomous action and system event,
mapped in one secure chain.
AI agents act autonomously, calling tools and modifying databases, while traditional backends and human operators trigger and verify them. Volidator gives you a single, unified, cryptographically sealed timeline across your entire hybrid ecosystem.
Prompt and Reasoning Capture
Log the system prompt, user input, chain-of-thought reasoning, and intermediate outputs. All encrypted before leaving your server. Your LLM provider never sees what you store.
Works with OpenAI, Anthropic, Gemini, and any model API.
Tool Execution Logs
Every tool call your agent makes, including which API, what parameters were passed, the model confidence score, and the response, is captured and cryptographically sealed.
LangChain, AutoGen, CrewAI, LlamaIndex, custom agents.
Decision Audit Trail
Chain reasoning steps, intermediate outputs, and final decisions into a tamper-evident sequence. Replay any agent session for compliance review, customer dispute resolution, or incident analysis.
SOC2 CC6.1, HIPAA 164.312, ISO 27001 A.12 compliant.
One Call. Full Audit.
Add AI agent auditing in one function call.
Call volidator.log() after any AI agent action. Pass the model, prompt, tool name, confidence, and token count in metadata. Everything gets encrypted client-side before dispatch. Your AI prompts and reasoning chains never touch Volidator infrastructure in plaintext.
SOC 2 auditors now ask about your AI agents.
Trust Service Criteria CC6.1 and CC8.1 now explicitly cover automated system actions, including autonomous AI agents. Volidator generates the evidence trail auditors need, automatically.
// Audit log autonomous AI agent tool executions and prompts client-side const completion = await openai.chat.completions.create({ model: "gpt-4o", messages: [{ role: "user", content: "Transfer $500 from savings to checking" }] }); // Capture system instructions, user prompts, reasoning, and tool executions // fully encrypted BEFORE sending to Volidator to prevent LLM data leaks. await volidator.log({ actor: "agent_financial_advisor_v3", action: "ai.tool_execution", target: "account_savings_12a", metadata: { model: "gpt-4o", user_prompt: "Transfer $500 from savings to checking", // Encrypted! reasoning: "User verified transaction via MFA, calling bank API", // Encrypted! tool_name: "bank_ledger_transfer", tokens_used: 480, confidence: 0.99 } });
Works with any LLM or orchestration framework
Compliance-ready audit logs,
without the integration headache.
Every log event you emit is automatically structured for SOC 2, HIPAA, and ISO 27001 evidence. Give your auditor a 7-day access room. No raw logs leave your perimeter.
Zero-Knowledge Storage
Evidence-Grade Audit Tags
Every call to volidator.log() stores a tamper-evident, cryptographically sealed record with a verifiable HMAC chain. This satisfies SOC 2 CC6.1, HIPAA 164.312, and ISO 27001 Annex A.12 audit controls, out of the box.
Zero raw logs leave your perimeter. Auditors see decrypted logs in their browser, not on our servers.
Auditor Access
7-Day Secure Auditor Rooms
Generate a scoped, time-limited access link for your CPA or auditor. The AES decryption key travels only in the URL hash fragment, architecturally invisible to our servers. Audit sessions expire automatically after 7 days.
SIEM Integration
Real-Time Log Forwarding
Every audit event is dispatched to a Cloudflare Queue and forwarded to Datadog or Splunk in real time. HMAC-signed payloads. Non-blocking ingestion. Your SIEM gets the full encrypted metadata, your privacy model stays intact.
Datadog
Logs API v2
Splunk
HEC Endpoint
Custom
Webhook + HMAC
Standards Volidator Audit Logs Are Structured For
CC6.1 - CC9.2 controls
164.312 audit controls
Annex A.9 + A.12 controls
Electronic records and audit
Capabilities
Engineered for AI-native production.
From day one.
Autonomous Agent Auditing
Log system prompts, reasoning steps, tool calls, and model tokens under client-side E2EE. Fulfill SOC2 and HIPAA audit requirements for LLM autonomy.
Searchable Blind Indexes
HMAC-SHA-256 per-project blind indexes let you filter logs by actor or action server-side with zero decryption required. Fast queries, zero exposure.
AES-256-GCM Encryption
Every event gets a random 12-byte IV. GCM authentication tags prevent tampering. Layout: [IV 12B][Ciphertext][Auth Tag 16B].
Hash-Fragment Key Isolation
The AES key lives only in the URL hash fragment, which browsers never send in HTTP requests. Keys are invisible to our servers by design.
SIEM Queue Forwarding
Every ingested log dispatches to a Cloudflare Queue for Datadog or Splunk. Batched writes, max_concurrency=1, DLQ for partial failures. Zero data loss.
Restricted Auditor Rooms
Generate secure guest access tokens valid for up to 7 days. Isolates the decryption keyring strictly to the auditor's browser URL hash fragment.
Embeddable Audit Widget
Drop a branded audit trail widget into your app with one iframe tag. Customers see their own decrypted logs with zero server overhead.
Any Language, Any Platform
Integrate Volidator into Next.js, Cloudflare Workers, Python, Go, Rust, or installed client gateways. Edge-native scale for any tech stack.
Pricing
Simple pricing.
Start free. Scale as you grow. No credit card required. Paid plans require an active subscription to maintain log retention (cancelled or unpaid accounts enter a 14-day soft-delete grace period before compliance history is pruned).
Starter
Side projects and prototypes.
- 10,000 logs or 100MB / month (whichever comes first)
- 3-day log retention
- Basic embeddable widget (Locked columns)
- Community support
Pro
Production SaaS applications.
- 500,000 logs or 35GB / month (whichever comes first)
- 3-month log retention (Unlocks compliance)
- Sub-5ms edge ingestion
- Customizable embed widget (Columns and paths)
- 7-Day Auditor Access Links
Scale
Mid-market SaaS scaling up.
- 3,000,000 logs or 100GB / month (whichever comes first)
- 6-month log retention (EU AI Act Compliant)
- Flight Data Recorder & Replay CLI
- Customizable embed widget (Columns and paths)
- Saved compliance views
- SIEM queue forwarding (Datadog/Splunk)
- 7-Day Auditor Room Access Links
- 60s edge-wide key revocation
Enterprise
High-throughput with custom SLAs.
- Custom logs and storage volumes
- Dedicated ingestion endpoint
- SLA-backed uptime and priority support
Enterprise-Grade Infrastructure
Your AI agents are making decisions.
Do you have a trail?
Every prompt your agent processes, every tool call it fires, every decision it makes. Cryptographically sealed. Queryable. Auditor-ready. Start in under 5 minutes, no credit card required.