Compliance • WORM Audits
Write Once Read Many (WORM) Audit Hash-Chain Ledger
Every automated rule execution, outbound webhook call, account mutation, and AI MCP tool call is recorded in an immutable audit ledger sealed with HMAC-SHA256 block hash chains.
1. HMAC-SHA256 Block Link Specification
Each audit entry H_n is cryptographically bound to the preceding entry H_(n-1), preventing retroactive tampering or record deletion:
H_n = HMAC-SHA256(SecretKey, seq || timestamp || actor || action || payload_hash || H_n-1)
2. CLI Verification Tooling
# Verify cryptographic hash chain integrity across all WORM ledger records nuncio store verify-audit-chain # Output recent audit events as JSON stream for SIEM / SOC ingestion nuncio audit list --limit 50 --json