Vault & Audit

Provenance Record Schema

One record per draw. The same record is written to the operational layer (KV, 90-day TTL) and the persistent layer (R2 JSONL, 7-year retention).

{
  "success": true,
  "request_id": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2026-09-02T14:22:08.117Z",
  "data": {
    "format": "hex",
    "length": 32,
    "entropy": "a1b2c3d4…",
    "encoding": "hex"
  },
  "provenance": {
    "source_class": "hardware-derived",
    "source_id": "qrng-hardware-001",
    "backend_class": "quantum",
    "entropy_score": 0.999,
    "conditioning": "von-neumann",
    "unique_states": 8192,
    "job_epoch": "epoch-2026-09-02-001"
  },
  "fallback": {
    "is_fallback": false,
    "reason": null
  },
  "audit": {
    "batch_family": "bf-2026-09-02-001",
    "draw_sequence": 42,
    "reservoir_remaining_bits": 1048576
  }
}

Every record carries provenance metadata linking the draw to its source, backend class, and audit batch for full traceability.

Chain Integrity

The hash chain makes retroactive tampering detectable. A replay procedure can be run against the full R2 JSONL stream to verify every record in sequence.

1. Hash record payload

SHA-256 over the canonicalized JSON of the draw payload, including provenance and audit metadata.
2. Link to prior record

Each record links to the prior record via audit batch family and draw sequence. Any modification of any prior record breaks the chain from that point forward.
3. Sign record

The hash-linked payload is signed with ML-DSA-65. The signature is stored alongside the record and can be verified by anyone with the verification public key.
4. Replay procedure

For a given window, the replay procedure reads records from R2, recomputes the hash chain, and verifies each signature. Mismatches are flagged with the record index and the offending field.

Verified and Enterprise tiers can run the replay procedure on demand via POST /v1/verify.

Dual-Layer Retention

Records live in two places with the same request_id. The two layers serve different operational needs.

Operational Layer

Edge KV Store · 90-day rolling TTL

High-speed read/write for telemetry
Per-key rate-limit counters
Metering hooks for billing
Immediate gateway observability
Designed for the operational dashboard

Persistent Layer

Cloudflare R2 JSONL · 7-year retention

Cryptographic compliance handoff
Full-batch provenance and signatures
Deep historical forensics
Region-pinned for data-residency
Replay-ready for regulator review

Record Lookup

GET /v1/audit/:id

{
  "success": true,
  "request_id": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2026-09-02T14:22:08.117Z",
  "data": {
    "format": "hex",
    "length": 32,
    "entropy": "a1b2c3d4…",
    "encoding": "hex"
  },
  "provenance": {
    "source_class": "hardware-derived",
    "source_id": "qrng-hardware-001",
    "backend_class": "quantum",
    "entropy_score": 0.999,
    "conditioning": "von-neumann",
    "unique_states": 8192,
    "job_epoch": "epoch-2026-09-02-001"
  },
  "fallback": {
    "is_fallback": false,
    "reason": null
  },
  "audit": {
    "batch_family": "bf-2026-09-02-001",
    "draw_sequence": 42,
    "reservoir_remaining_bits": 1048576
  }
}

Available on Verified and Enterprise tiers. Lookup latency < 50 ms P95 globally.

Compliance Hand-off

For regulated customers, a Compliance Pack is available under NDA. The pack contains: full schema reference, replay procedure documentation, retention policy, cryptographic posture, and pen-test summary.

Request: [email protected]

Audit your draws

Verified and Enterprise tiers unlock the lookup endpoint and on-demand replay.

Request Access Architecture

Vault & Audit

Provenance Record Schema

Chain Integrity

1. Hash record payload

2. Link to prior record