On demand
Export the log, filtered to the events the request asks for.
CSVJSONCEFLEEFOCSF
Trustaige · Platform · Audit & governance
Evidence that doesn't need translation.
Every sign-in, policy decision and admin action goes into one hash-chained log, verified every day, and leaves in the formats your SOC and your auditors already read. Access reviews close the loop: access nobody vouches for is removed at the deadline.
The audit layer
Every event attributed. Readable by every tool you run.
Trustaige's audit layer is append-only. Each event records who performed the action (a person, an admin, or a system job), what was done, where it happened, which policy fired, and the exact outcome. Every event is chained to the one before it by hash; the chain is checkpointed and verified end to end every day, and the hub shows its integrity at a glance, so a record altered after the fact shows.
A log that can't be translated is a log that doesn't work. Ours speaks the five formats yours already read — CEF for ArcSight, LEEF for QRadar, OCSF for the cloud-native security stack, plus JSON and CSV when a spreadsheet is what the auditor wants.
Getting it out
Three ways the record leaves Trustaige.
Your SOC wants events as they happen. Your auditor wants a file. Your data team wants a batch it can load overnight. Each comes from the same hash-chained log.
Live
Stream events by webhook to any SIEM that accepts JSON, CEF, LEEF or OCSF, as they happen.
SplunkSentinelDatadogElastic
Daily batch
Once a day, deliver every event since the last batch to your own endpoint, for systems that load in bulk rather than listen.
Your endpointDaily
Governance & evidence
Proof that everyone with access still needs it — and that the record still holds.
Governance · who still needs access
Access review campaigns
Ask app owners, managers or group owners to confirm or revoke each person's access by a deadline. Reviewers get reminders on the days you choose, and access left unreviewed at the deadline can be revoked automatically.
Entitlement reports on demand
"Who has access to this application, today?" Trustaige answers in seconds with a report exportable to CSV or JSON. The report your auditor wanted last quarter is the report your team can produce in this meeting.
Stale-access reports
Find the people who hold access to an application but haven't signed in to it lately, or ever, and export the list as CSV or JSON for the next review.
Integrity · a record that still holds
Retention and legal holds
On paid plans, keep events for a year by default or set your own policy up to ten years. A legal hold keeps the events a matter depends on past any retention policy, and placing or releasing one is itself recorded.
Erasure that keeps the chain
When a person's data has to be erased, their personal fields are redacted from the log and a receipt takes their place. The hash chain still verifies, so honouring a privacy request never costs you the integrity of the record.
Two keys for what matters most
A protected application can't be deleted or switched off. Releasing it takes a second superadmin's approval, and erasing a managed Mac, iPhone or iPad takes two superadmins. One stolen admin account can't do either.
Start a conversation
If your auth layer is on the agenda, so are we.
We'll walk through a working deployment, map it to your stack, and tell you honestly where Trustaige fits — and where it doesn't.