Ledgerstore
Append-only · Cryptographically verifiable

Ledgerstore is an immutable, append-only database for the records that get subpoenaed. Every write is hash-chained to the one before it, so your history can be proven instead of trusted. There is no UPDATE. There is no DELETE. There is no quiet edit at 2am.

  • Tamper-evident by design
  • SQL reads, frozen writes
  • 8ms median append
append.sql
INSERT INTO audit.events (actor, action, target)
VALUES ('u_8821', 'role.grant', 'admin');

-- seq 4,210,338  ·  committed in 6ms
-- prev  9f2c…a17e
-- hash  c4d1…7b09   ✓ chain intact

UPDATE audit.events SET action = 'noop';
ERROR 42P01: relation "audit.events" is append-only
DELETE FROM audit.events WHERE seq = 4210337;
ERROR 42P01: relation "audit.events" is append-only

Holding the records that show up in discovery

VaultwiseNorthgate TrustAtlas ClearingSentinel HealthCohort LabsMeridian GovVaultwiseNorthgate TrustAtlas ClearingSentinel HealthCohort LabsMeridian Gov
Why append-only

A database that canprove it wasn't touched.

A normal database answers "what is the data right now?" Ledgerstore answers "what happened, in what order, and can you prove nobody rewrote it after the fact?" That gap is the difference between a log and evidence.

Hash-chained writes

Every record carries the hash of the record before it. Change one row and every hash downstream stops matching — tampering doesn't hide, it screams. Verifying the whole chain is one API call, not a forensics engagement.

No UPDATE, no DELETE

The two statements that erase the past aren't in the grammar. Corrections are new events that supersede old ones, so the mistake and the fix both survive. Auditors read the full story, not the cleaned-up version.

Merkle anchoring

Every few seconds a Merkle root is anchored to write-once storage outside the cluster. A rogue admin with root can rewind their own copy, but they can't rewind the anchor — the two stop agreeing, and that disagreement is the alarm.

Point-in-time replay

Reconstruct the exact state of any record at any second in its history. "Who had admin on March 3rd at 14:02?" becomes a SELECT, not a week of log spelunking.

Reads you already know

Query with plain SQL over your existing Postgres drivers. Writes are immutable; reads behave like the database you already run. Nothing new to learn, nothing to rewrite.

Built for records that outlive the engineers who wrote them

8ms
Median append latency
1M+
Events / sec / cluster
7yr
Default retention floor
100%
Writes hash-chained
How it works

Three guarantees,enforced by math —not by policy.

Immutability here isn't a permission you can revoke or a flag an admin can flip. It's structural — built into how every byte is stored, sealed, and proven.

1 · Write

An event lands with a monotonic sequence number and the hash of its predecessor. The moment it commits, its bytes are frozen: there is no code path anywhere in Ledgerstore that mutates a committed event.

2 · Seal

Batches roll into a Merkle tree, and the root is anchored to write-once object storage off-platform every few seconds. The seal ends up somewhere your own operators can't reach to undo it.

3 · Prove

Pull an inclusion proof for any record and verify it yourself — with our open verifier or fifty lines of your own code, no Ledgerstore access required. The proof is a few hundred bytes and travels straight into an audit binder.

Verify continuously

A background verifier re-walks the entire chain around the clock and pages you the second a single link fails to match. You hear about tampering in seconds — not from a regulator a year later.

Where teams put it

The system of recordbehind the records.

Wherever "who did what, and when" has to survive a lawyer, an auditor, or a breach, Ledgerstore is the layer sitting underneath it.

Security

Access & permission logs

Every grant, revoke, and login lands as a frozen event — so when you're reconstructing a breach, the timeline is one nobody could have edited on their way out the door.

Fintech

Financial audit trails

Append each ledger movement and approval as it happens. Hand regulators a portable cryptographic proof of the sequence — not a CSV export and your word that it's complete.

Healthcare

Clinical & consent records

Capture consent, access, and chart edits under HIPAA in a history that survives staff turnover and litigation, because no clinician or DBA can quietly revise what was recorded.

AI / ML

Model & data provenance

Seal every training set, prompt, and deploy decision the moment it's made, so two years later you can prove exactly what the model was trained and shipped on — to a board, a court, or a regulator.

Logistics

Supply-chain custody

Record each hand-off and inspection as a sealed event that every partner can verify independently — a chain of custody with no single party holding the eraser.

Platform

Change & config history

Treat every infra change as an immutable event. After an incident, replay the exact order of what shipped before it broke — instead of arguing over who pushed what.

From the teams holding the line

When the auditor calls,they stay calm.

SOC 2 evidence used to be a quarterly fire drill of screenshots and spreadsheets. Now the audit trail is the source of truth and we hand over a proof file. Our auditor stopped asking for screenshots three cycles ago.

H
Helena V. Marsh
Head of Security, Vaultwise

A former engineer swore a record had been altered after he left. We pulled the inclusion proof and the hash chain ended the argument in four minutes. On vanilla Postgres that's a forensic firm and a very bad week.

D
Diego Salcedo
VP Engineering, Atlas Clearing

What sold our board was the part where I admitted I can't cheat it either. Not me, not with root, not on a bad day — the system simply has no path to delete a consent record. That's the whole point.

D
Dr. Priya Raman
CISO, Sentinel Health
Pricing

Pay per event. Keep them forever.

Metered on writes — not seats, not storage tiers. Reads and verification are always free, because proving your data shouldn't cost extra.

Developer

For prototypes and side projects.

$0/mo
  • Up to 1M events/mo
  • 1 ledger
  • SQL reads + inclusion proofs
  • 7-day Merkle anchoring
  • Community support
Most popular

Team

For products with real audit requirements.

$390/mo
  • Up to 50M events/mo
  • Unlimited ledgers
  • Continuous chain verification
  • External Merkle anchoring
  • One-click SOC 2 evidence export
  • Priority support

Regulated

For finance, health, and government.

Custom
  • Unlimited events
  • Single-tenant clusters
  • Data residency (US · EU · CA)
  • Customer-held anchoring keys
  • Named compliance engineer
  • BAA + audit support

The questions auditors ask first.

How is this different from an audit table or a write-ahead log?

Both can still be UPDATEd or DELETEd by anyone with the right access — your audit trail is only as honest as your most privileged admin on their worst day. Ledgerstore removes mutation from the data model entirely and hash-chains every write, so tampering breaks the chain and is provable, not just frowned upon.

Isn't this just a blockchain?

No, and that's deliberate. There's no token, no consensus network, no proof-of-work tax on every write. You get the one property teams actually need from that world — tamper-evident, independently verifiable history — at database latency, behind plain SQL, anchored to storage you control. It feels like Postgres, not like running a node.

If I can't UPDATE or DELETE, how do I fix a mistake?

You append a correcting event that supersedes the original. The reads API resolves to the current state, while the full lineage — original error included — stays intact. Your app sees the right answer; your auditor sees the correction and the history behind it.

Can I really verify integrity without trusting you?

Yes — that's the design goal. Inclusion proofs and Merkle roots are portable and standards-based, so you can verify any record with our open-source verifier or your own code, against an anchor you hold. The guarantee never reduces to "trust Ledgerstore."

What about GDPR and right-to-be-forgotten?

Keep personal data encrypted off-chain and store only hashes and pointers in the ledger. Crypto-shredding the key makes the payload permanently unrecoverable, while the immutable proof that the event existed and where it sat in the order stays intact. Erasable contents, unerasable record.

Is it actually fast enough for production writes?

Median append latency is around 8ms and a single cluster sustains over a million events per second. Hash-chaining happens inline as part of the commit, so immutability costs you almost nothing at write time.

How hard is it to migrate my existing logs in?

Bulk-import your historical records, we seal them into a starting chain, and you point your app at the append API. Reads stay standard SQL over your existing drivers, so most teams are live the same afternoon.

Write one recordyou'll never be able to delete.

Spin up a ledger, append an event, and pull a cryptographic proof of it — in under five minutes, with no sales call between you and your first write.