Security

How Santati protects your audit trail

Your customers' auditors rely on the evidence Santati stores. Here's how we protect it, and how you can check it yourself.

01 / Integrity

Tamper-evident trails

Every live event is sealed into a per-trail SHA-256 hash chain; each event's hash covers its contents and the previous event's hash.
GET /api/v0/events/chain/verify/ checks any time range and returns ok or broken along with the position of the first break.
Each verification produces a downloadable report that anyone can re-check with a standard SHA-256 implementation. Download links expire after 24 hours.

02 / Access

Keys belong to one team and carry one scope: read, write (emit and read) or manage (read, manage streams and the event catalog). A key can be limited to named trails; only a key that is not limited can change the event catalog.
Only a SHA-512 hash of each key is stored; the full key is shown once.
Keys can expire after 1–3,650 days, rotate with a 24-hour overlap, and be revoked immediately and permanently.
Only team admins can create, rotate or revoke keys.

03 / Retention

Retention is set per organization, up to your plan's ceiling, and can be extended but never shortened.
One scheduled daily job is the only process that deletes events, and each run is recorded in a purge ledger.
Legal holds pause deletion for a whole organization or a matched set of events until an admin releases them.

04 / Delivery

Each log stream delivery is signed per the Standard Webhooks spec (HMAC-SHA256). Signing secrets rotate with a 24-hour overlap.
Destinations must use HTTPS. Private, loopback and link-local addresses are refused, and redirects are not followed.
Failed deliveries retry with exponential backoff and then move to a dead-letter queue. Admins can replay them, and failing streams send email alerts.

05 / Accounts

Two-factor authentication with an authenticator app (TOTP), plus recovery codes.
Sign in with Google, GitHub or a one-time code sent by email.
Two team roles, admin and member. API keys, log stream replay, legal holds and organization settings are admin-only.
Changes to API keys and log streams are recorded, through Santati's own API, in an account audit log that your team admins can read.

06 / Operations

All traffic uses HTTPS. HTTP requests are redirected, and session and CSRF cookies are marked Secure.
The service runs on Fly.io in the United States.

Email support@santati.io with steps to reproduce. Please give us a chance to fix the issue before disclosing it publicly.