Doolta
Prooflog
GitHub →Cryptographic evidence continuity for critical security events: proof that nothing is missing, not just that nothing was altered.
Project Details
- Real problemProve that a timeline of critical events (deployments, access changes, backup tests, secret rotations) was actually observed, ordered, and retained without silent rewriting: a WORM store proves nothing was deleted, a ledger proves nothing was altered, neither proves nothing is missing.
- Structural choicesStrict separation into three roles (Agent, Store, Verifier), with the Verifier operating under authority independent from the Store and rejecting any inconsistent signed checkpoint. The Store never holds decryption keys and cannot read the events it stores. Built on open standards: SHA-256 chains, Merkle trees, checkpoints compatible with the Go ecosystem (sumdb, sigsum, Rekor).
- What it proves todayOpenly pre-alpha, but on a solid base: a test suite with race detection, a working adversarial demo that catches 4 out of 4 simulated attacks, architecture decisions documented and traced down to the code.
- Associated offerBespoke integrity audits and proof systems. Get in touch.
Neither a WORM store nor a ledger is enough: one proves nothing was deleted, the other that nothing was altered, neither proves nothing is missing. Prooflog closes that gap for security events that must stay verifiable over time, with a Verifier deliberately independent from the system that stores the evidence.
This project demonstrates a rare capability: designing proof systems where every security guarantee is explicit, tested against adversarial scenarios, and honest about its own limits.