When your AI agent is challenged, bring receipts.
Logsiegel gives AI systems and agents a tamper-evident action trail — every step hash-chained and signed, verifiable offline by anyone you hand a receipt to. Open source, no blockchain required, runs where your agent runs.
Join the waitlist →AI systems are probabilistic — errors are part of normal operation. The question is whether you can show, after the fact, what actually happened. “Our logs say X” proves nothing — database logs are silently editable, and everyone knows it.
$ logsiegel verify ./trail ✓ 1,285 entries · hash chain + Merkle roots + signatures · all valid # entry 1284 is the action being disputed — hand out just that one, as a receipt $ logsiegel receipt ./trail --seq 1284 --out receipt.json ✓ receipt.json · entry 1284 + inclusion proof + signed checkpoint # the other side verifies it themselves — no access to your systems, just your key $ logsiegel verify-receipt receipt.json --pubkey logsiegel.pub ✓ VALID · entry 1284 committed · signed by acme.example/support-bot $ ./tamper ./trail # someone edits one entry, after the fact $ logsiegel verify ./trail ✗ FAIL — checkpoint 3: Merkle root mismatch (entries modified)
A receipt is one action you can hand to a customer, auditor or court. They verify it against your published key — offline, no account, no access to your systems.
Provable, not just observable.
Observability shows what happened. Logsiegel makes it provable: any after-the-fact edit, reorder or truncation fails verification — loudly.
Receipts for single actions.
Hand a customer, auditor or ombudsperson one log entry plus its proof. They verify it offline with your public key alone — no access to your systems, no account. They trust the math, not your word.
Privacy built in.
Only hashes and metadata enter the log. Content stays encrypted, maskable, and deletable (crypto-shredding) — GDPR deletion rights and tamper-evidence stop being a contradiction.
Tamper-evident, not tamper-proof — it proves the integrity of what was logged, not that everything was logged. The README ships a threat model that says exactly what is proven, against whom, and what isn't. No security theater.
We didn't roll our own crypto.
Logsiegel is — quite literally — the Certificate Transparency construction (RFC 6962): the system that has safeguarded every HTTPS certificate on the internet for over a decade. We inherit its Merkle-tree proofs and its mature tooling, and leave out what an action trail doesn't need: consensus, tokens, a global ledger. Boring, proven cryptography — applied to a new problem.
How it works
The docs before the docs — four parts, no magic:
The trail
An append-only log. Every entry is hash-linked to the one before it; payloads are encrypted per entry, so content can be masked or deleted without breaking the chain.
Checkpoints
Periodic Merkle roots over the trail, signed with Ed25519. Anyone who holds a checkpoint can detect any later edit, reorder or truncation of everything beneath it.
Receipts
One entry + its inclusion proof + a signed checkpoint, in a single file. Proves that exact action was in the trail — without exposing anything else in it.
The verifier
A CLI and a browser verifier that check trails and receipts offline, against your published public key. No account, no server, no access to your systems. Try it in your browser →
pip install logsiegel → plug in the adapter
(LiteLLM today, MCP proxy for agents coming) → checkpoint, verify, done.
Anchoring: three tiers
A trail you keep to yourself proves a lot — a trail anchored outside your own infrastructure proves more. Logsiegel is built as a base layer with pluggable anchors:
Local today
Chain, checkpoints, receipts and offline verification — entirely on your own infrastructure. Free, permanently.
Independent witness next stage
A named third party counter-signs your checkpoints and checks their consistency — so a log operator can't maintain two versions of history. The protocol is designed for multiple independent witnesses; this is the next stage of the project.
Qualified timestamps & public anchoring planned
Under eIDAS (Art. 41(2)), a qualified electronic timestamp carries the legal presumption that the data existed unaltered at the stated time — the architecture is designed to plug into that. And for those who want trust in no single party at all: optional anchoring to public chains. No token, no consensus requirement — an optional extra layer, never the foundation.
Why tiers? Different disputes need different strength. A dev team debugging an agent needs the local tier; a regulated operator answering an auditor will want external anchoring. You upgrade the assurance level — the trail format stays the same.
What does it cost?
The core is open source (Apache 2.0) and free — permanently. Verifying is free for everyone, always: a receipt must never sit behind a paywall. Paid operations services (such as a professionally run independent witness) may follow once they exist — running Logsiegel on your own infrastructure stays free.
Early access to the agent-trail SDK as it lands
MCP proxy, mandate binding, witness anchoring. Waitlist members shape the roadmap; pilot teams get hands-on integration support.
Join the waitlist →Have a pilot code? Skip the line.