VCAL Audit
A self-hosted evidence retention and traceability service for AI Cost Firewall deployments. Reconstruct request lifecycles, retain structured operational evidence, and verify stored records through an authoritative SHA-256 hash chain.
Built for teams that need self-hosted AI traceability, retained operational evidence, and a foundation for future SIEM, SOAR, and compliance integrations.
Reconstruct request lifecycles
Correlate request validation, guard decisions, cache processing, upstream calls, and terminal outcomes through a stable trace identifier.
Verify retained evidence
Store accepted evidence in authoritative sequence order and verify a SHA-256 record chain to detect unexpected modifications.
Query, export, and observe
List retained evidence, reconstruct traces, export NDJSON, and monitor ingestion, persistence latency, authentication, and chain verification.
A durable evidence boundary for AI Firewall
AI Cost Firewall emits structured evidence during request processing and delivers it asynchronously to VCAL Audit. Audit validates each batch, assigns authoritative sequence numbers, persists new events atomically, and updates a tamper-evident record chain.
Chatbot, RAG, agent, or API client
Emits correlated evidence events
Validates, sequences, and persists
Durable evidence and record chain
Retain, investigate, verify, and export
VCAL Audit provides a compact evidence service for pilots and production-oriented single-node deployments.
Ingest
Accept authenticated evidence batches with schema validation, atomic persistence, and duplicate-event handling.
Investigate
List events in sequence order and reconstruct complete request lifecycles by stable trace_id.
Verify
Recalculate the authoritative SHA-256 record chain and identify the first invalid sequence if verification fails.
Export
Export retained traces as NDJSON for investigation, archival, and future SIEM or SOAR integration.
Self-hosted, compact, and independently deployable
VCAL Audit runs as a separate service close to AI Cost Firewall. The current implementation uses SQLite with write-ahead logging and full synchronous commits, making it suitable for pilots and controlled single-node deployments that prioritize durable, ordered evidence.
Pilot deployment includes
- • Self-hosted Audit service
- • AI Cost Firewall buffered delivery integration
- • API-key protected evidence endpoints
- • SQLite evidence persistence
- • Health, readiness, version, and metrics endpoints
- • Grafana dashboard for Audit operations
Where VCAL Audit helps
Incident reconstruction
Rebuild the path of a request across validation, guards, cache activity, upstream calls, and terminal outcomes.
Guard decision review
Correlate Security Guard and Privacy Guard decisions with the surrounding request lifecycle.
Operational evidence retention
Retain metadata-first evidence independently of application logs and short-lived observability data.
Integrity verification
Verify whether stored records and their authoritative sequence remain consistent with the Audit hash chain.
Evidence export
Export traces as NDJSON for controlled investigation, archival, and downstream processing.
Compliance preparation
Create a traceability foundation for future compliance controls, reporting, and SIEM or SOAR integrations.
The evidence layer for broader AI governance
VCAL Audit complements AI Cost Firewall, VCAL Privacy Guard, and VCAL Security Guard by retaining structured evidence outside the request path. It establishes the traceability layer needed for investigation, future compliance controls, and integration with enterprise security operations.
FAQ
Is VCAL Audit available now?
It is available for enterprise pilots. General public self-serve distribution is not the primary model at this stage.
Does it send evidence to VCAL?
No. The intended deployment model is self-hosted inside your own environment, close to AI Cost Firewall and your application traffic.
Does it store prompts and responses?
AI Firewall's current evidence events are metadata-first and do not normally contain prompt or response bodies. Producers should still control free-form attributes to prevent unnecessary sensitive data retention.
Is the evidence immutable?
The stored records are tamper-evident through an authoritative SHA-256 hash chain. The current implementation does not yet provide external immutable anchoring.
Interested in a VCAL Audit pilot?
Contact VCAL to discuss evidence requirements, retention scope, AI Cost Firewall integration, deployment architecture, security review, pilot metrics, or enterprise packaging.