For auditors
Read the work, then verify the chain.
When AI does the compliance work, the question you have to answer is not whether the answer looks right. It is whether you can trust how it was produced, who approved it, and that the record has not been edited since. Kanonik is built to answer exactly that.
What the record gives you
Evidence that stands on its own.
Every committed change carries the full chain of custody. You read the deliverable the same way you always have; the difference is what sits behind it.
Hash-chained, append-only
Each event references the hash of the one before it. The chain root is signed with a FIPS-validated key. An edited or deleted entry breaks the chain, and the break is detectable.
Outside the system being audited
The audit log is not a table inside the application the team controls. It is a separate, non-bypassable substrate. The people doing the work cannot quietly rewrite the record of it.
Who proposed, who approved
Every change names the actor who proposed it and the human who approved it through a single-use, time-boxed, payload-bound token. Approval happens server-side, not in a chat window.
The reasoning, not just the result
Each AI-produced change records the inputs, the skill version, the model and provider, the Verifier verdict, and the retrieved evidence. Enough to re-run the reasoning and reach the same conclusion.
As-of, not just current
The canonical model records both when something happened and when it was entered. You can ask what the program looked like on any past date, not only what it looks like today.
Signed export you verify offline
The auditor export is a signed bundle: the events, the rendered artifacts, the chain root, and an open-source verification tool. You confirm the chain without trusting Kanonik's servers.
The candid part
Gaps are flagged, not hidden.
A control with no evidence on file is recorded as a gap and surfaced for treatment. The system will not assert effectiveness it cannot support. When the Verifier is not confident, the change is held for review rather than committed.
That is the point of the design. The record is more useful to you because it is willing to say what is missing.
Do I need a Kanonik account to verify an export?
No. The signed bundle and the verification tool run offline. You confirm the hash chain and the signature on the chain root without any access to the live system.
Can the team edit history before an audit?
The event store is append-only. Corrections are new events that reference the prior state; nothing is removed. An attempt to alter a past entry breaks the chain and is detectable on verification.
Which framework is supported today?
Kanonik runs ISO 27001:2022, SOC 2, GDPR, and NIST CSF 2.0 today. The substrate is framework-agnostic by construction; framework specifics are loaded as a package, never hardcoded into the product.
A Sealed Audit Package includes a 90-day auditor access window for your client's auditor. If you are auditing an organisation that runs Kanonik, ask them for a signed export and verify it yourself.
The proof is the product.