Records anyone can verify, without trusting your database.
Invoance is an API that hashes, signs and stores your critical events, documents and AI outputs in an append-only ledger. Each record gets a link a customer, auditor or regulator can check on their own.
Audit Logs
Signed activity logs for each of your customers, with a viewer they can open themselves.
POST /v1/audit/eventsEvent Ledger
An append-only, signed record of the business events you may need to prove later.
POST /v1/eventsAI Attestation
A signed record of what a model was asked, what it answered, and which model it was.
POST /v1/ai/attestationsDocument Anchoring
Proof that an exact file existed at a given time, without handing the file over.
POST /v1/document/anchorTraces
Group events, documents and AI attestations into one sealed record of a whole process.
POST /v1/tracesHow a request becomes a signed record.
Your payload is normalized, hashed with SHA-256 and signed with an Ed25519 key that belongs to your organization. The row is written to a ledger where the database itself refuses deletes.
- POST /v1/eventsAPI key + Idempotency-Key
- Canonical JSONKeys sorted, stable bytes
- SHA-256payload_hash, request_hash
- Ed25519Your organization's key
- Append-only ledgerRows cannot be deleted
import { InvoanceClient } from "invoance";
// Reads INVOANCE_API_KEY from the environment.
const client = new InvoanceClient();
const result = await client.events.ingest({
eventType: "policy.approval",
payload: {
policy_id: "pol_8472",
approved_by: "risk_committee",
decision: "approved",
},
});
console.log(result.event_id);
{
"event_id": "7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4",
"match_result": true,
"matched_field": "payload_hash",
"anchored_hash": "a3f2b1c9d4e8f70b…5c2b7e80",
"submitted_hash": "a3f2b1c9d4e8f70b…5c2b7e80",
"anchored_at": "2026-09-22T08:14:07.412Z",
"method": "sha256",
"organization": {
"name": "Acme Inc",
"primary_domain": "acme.com",
"domain_verified": true
}
}
Verification takes the payload or its hash and answers one question: does it match what was signed? The response names the issuing organization and whether its domain is verified.
- A specific record existed in a specific form.
- It was signed by a specific organization at a specific time.
- What you are looking at still matches what was signed.
- A sealed trace has had nothing added, removed or reordered.
- That the underlying statement is true.
- That a decision was fair, legal or correct.
- That a document's contents are authentic.
- That you meet a legal or regulatory obligation.
Create your first signed record.
The Developer plan is free and covers all five products: 10,000 audit events, 1,000 ledger events, 50 AI attestations, 50 document anchors and 250 traces a month.