Tamper-Evident
Audit Logs for SOC2

Cryptographically verifiable audit logs on Cloudflare Pages. Every event signed with Ed25519, every window dual-signed (Ed25519 + ML-DSA-65), anchored to public transparency log.

● Live API Apache 2.0 Self-Hostable Post-Quantum Ready Cloudflare Native

View Live API → View Source

Live System

—

API Version

—

Health

—

Endpoints

—

Cloudflare Region

Why Wax?

Cryptographically Verifiable

Every event is Ed25519-signed. Auditors verify the entire chain offline with no server trust required.

Minute-Level Windows

1-minute Merkle windows keep proof sizes bounded. Dual-signed with Ed25519 and ML-DSA-65.

Self-Hostable

Deploy to your own Cloudflare account with one `wrangler deploy`. Your data stays on your infrastructure.

Public Anchoring

Window roots anchor to a public transparency log and Bitcoin via OpenTimestamps.

Compliance-Ready

Direct mapping to SOC2 CC6/CC7, HIPAA 164.312, and ISO 27001 Annex A controls.

Offline Verification

@wax-protocol/verify runs on any laptop. No Wax server trusted at verification time.

Start Logging in 30 Seconds

Install the SDK, generate a keypair, append your first signed event.

npminstall

$ npm install @wax-protocol/client @wax-protocol/verify

client.tsappend-event.ts

import { WaxClient } from '@wax-protocol/client';

// 1. Initialize the client
const wax = new WaxClient({
  apiUrl: 'https://wax-api.carelessapparelllc.workers.dev',
  tenantId: 'tenant_01KZEFPM9F62HPR8XKXBEYQHA4',
});

// 2. Generate a signing keypair
const { privateKey, publicKey } = wax.generateKeyPair();
wax.setKeyPair(privateKey, publicKey);

// 3. Create a stream (one-time)
const stream = await wax.createStream('audit-log');

// 4. Append a signed event
await wax.appendEvent({
  stream_id: stream.id,
  actor: { type: 'user', id: 'u_123', key_id: wax.publicKeyToHex(publicKey) },
  action: 'auth.login',
  target: { type: 'session', id: 's_abc' },
  payload: { content_type: 'application/json', hash: 'e3b0c4...' },
});

auditor.tsoffline-verify.ts

import { verify } from '@wax-protocol/verify';

// Fetch the inclusion proof from the API
const proof = await fetch(`https://wax-api.carelessapparelllc.workers.dev/v1/proof/${eventId}`)
  .then(r => r.json());

// Verify offline — no Wax server trusted
const result = verify(
  proof.event,
  proof.proof,
  proof.window,
  'your-tenant-public-key-hex'
);

if (result.valid) {
  console.log('✓ Event cryptographically valid');
} else {
  console.error('✗ Failed:', result.error);
}

REST API

All endpoints return JSON. Authenticate with the X-Wax-Tenant header.

POST /v1/tenantsCreate a tenant

curl -X POST https://wax-api.carelessapparelllc.workers.dev/v1/tenants \
  -H 'Content-Type: application/json' \
  -d '{"name":"acme-corp","root_public_key":"abc123..."}'

POST /v1/eventsAppend a signed event

curl -X POST https://wax-api.carelessapparelllc.workers.dev/v1/events \
  -H 'Content-Type: application/json' \
  -H 'X-Wax-Tenant: tenant_01KZ...' \
  -d '{"event":{"id":"01...","stream_id":"stream_01...","seq":1,...}}'

GET /v1/proof/:idFetch inclusion proof

curl https://wax-api.carelessapparelllc.workers.dev/v1/proof/01HZTEST... \
  -H 'X-Wax-Tenant: tenant_01KZ...'

How Wax Compares

	Wax	Splunk Cloud	Datadog Logs	AWS CloudTrail
Per-event cost	Free (self-host) / Included	~$0.50/GB	~$0.10/GB	$2/100K
Tamper-evident	✓ Cryptographic	✗ Vendor trust	✗ Vendor trust	✗ Vendor trust
Self-hostable	✓ One wrangler deploy	✗ No	✗ No	✗ No
Post-quantum	✓ ML-DSA-65	✗ No	✗ No	✗ No
Anchored to public log	✓ Wax + Bitcoin	✗ No	✗ No	✗ No
Offline verification	✓ Yes	✗ No	✗ No	✗ No

Tamper-EvidentAudit Logs for SOC2