Tamper-evident audit log, customer-owned signing keys, open-source verifier CLI. One-click reports for NIS2, SOC 2, ISO 27001, GDPR, HIPAA. EU-hosted.
Vanta, Drata, Sprinto, and Secureframe cover the modern-SaaS slice — AWS, GCP, Okta, GitHub, Jira. None of them touch the BMCs in your racks.
That's our slice. We ship evidence two ways: as a one-click compliance report PDF, and as a stream of audit events over SIEM webhook — so it lands in whatever GRC tool you already pay for. You don't pick KVM Fleet instead of Drata; you pick KVM Fleet to plug into Drata.
SHA-256 hash-chained over every access event, policy decision, power action, ISO mount, and cert issuance. Append-only at the database level — a Postgres trigger refuses any UPDATE or DELETE.
You upload an Ed25519 public key. Every chain anchor we publish is signed by your private key (held in your HSM or secrets manager; the platform never sees the private half).
kvmfleet-verify walks an exported log, recomputes SHA-256, and validates signatures and Merkle inclusion proofs — without touching the platform. Apache 2.0. Your auditor runs it against your evidence pack.
Per-day Merkle root with per-event inclusion proofs. Any single event can be proven to belong to the chain head you exported.
Per framework, download a PDF that maps our audit-log evidence to the framework's control catalogue, with an integrity-verification section in every report.
Stream every audit event to your existing SIEM (Splunk HEC, Elastic, Sumo, Datadog) or to a Vanta / Drata custom collector. Per-org event filter, delivery tracking, retry-with-backoff.
SOC 2 expects 365 days, ISO 27001 commonly 3 years, HIPAA 6 years, EU financial services 10. Set the window per org; the janitor sweeps past the threshold and bumps the chain anchor so the verifier still passes.
Point us at a witness endpoint you control (Sigstore Rekor, an internal HSM, an S3 immutable bucket). We publish chain anchors there so you can cross-check independently.
Most compliance platforms tell you their evidence is correct and expect you to take their word for it. We sign the chain anchor with your key and publish an open-source CLI so your auditor can verify our entire chain without trusting us.
Run this against an exported chain bundle:
The CLI is Apache-2.0 at github.com/KVMFleet/audit-verify. Vendor it in, run it in CI, hand it to your auditor — your call.
Start free, generate a sample evidence pack, run the verifier against it. If your compliance team is satisfied, upgrade. EU-hosted; DPA published.