Prove the record wasn't tampered with.
Provenance composes three primitives into one bundle: detached signing that a third party verifies without your keys, an append-only audit chain where a single altered row breaks every link after it, and per-tenant field encryption sealed at rest. Own the source, and hand an auditor a signature instead of a promise.
$ caisson evidence verify pack.json ✓ ed25519 signature valid ✓ rfc-3161 timestamp valid ✓ audit chain 0 breaks root 2c9f…b7 · 41984 rows provenance intact
What it composes
The Provenance bundle is a real runtime composition of three @caisson/* packages, not marketing copy: signing-primitive (detached Ed25519 + RFC-3161 signing over evidence bundles and audit roots), audit-worm (the append-only SHA-256 audit chain plus the S3 Object-Lock WORM adapter), and field-crypto (per-tenant HKDF-SHA256 + AES-256-GCM field encryption). Every member is a workspace dependency re-exported through the bundle's own entry point, and every one is also a member of Compliance, so a Compliance owner already holds the whole set.
Three packages, one bundle.
Each member is a real workspace dependency, not a manifest claim. Each is also sold standalone, so you can take exactly the primitive you need.
Per-tenant field encryption via HKDF-SHA256 + AES-256-GCM, a leaked tenant key exposes one tenant, never the table.
An append-only SHA-256 audit chain plus an S3 Object-Lock WORM adapter: tamper with a historical row and every link after it breaks, provably.
Detached Ed25519 + RFC-3161 signing over an evidence bundle or an audit root, a signature a third party verifies without ever touching your keys.
Four primitives, each with its proof.
No diagrams standing in for behaviour. The artifact carries the claim, a signature, a chain root, a denied delete, a refused cross-tenant decrypt.
Sign an evidence bundle or an audit root with a detached Ed25519 signature and an RFC-3161 timestamp. The signature travels with the artifact; a verifier checks it with your public key alone, the private key never leaves your side of the boundary.
caisson evidence verify pack.json → sig ✓ · tsa ✓ · root 2c9f…b7Each audit row commits SHA-256 over the previous hash plus its own payload. Tampering with any historical row breaks every link after it, and the break is detectable, provable, and exportable for an auditor.
caisson audit verify → 41984 rows · 0 breaks · root 2c9f…b7Evidence buckets ship with S3 Object Lock in GOVERNANCE mode and a default retention, with a typed, recorded escalation to COMPLIANCE mode at launch. Inside the window an object cannot be overwritten or deleted through any normal path, not by a bug, not by an operator.
delete-object → AccessDenied: WORM-protected until 2033-06-27ZSensitive columns are sealed with a data key derived per tenant from a root KMS key via HKDF-SHA256. A leaked tenant key exposes one tenant, never the table; rotating the root re-derives every key with no re-encrypt scan.
hkdf(rootKey, tenantId) → DEK·A cannot open DEK·B ciphertextTeams that have to prove a record, not just store it.
Teams where the question isn't 'do you have the data' but 'can you prove it wasn't changed', regulated records, legal holds, model-output audit trails, evidence you may have to defend years later. Provenance gives you a signature, a tamper-evident chain, and sealed-at-rest fields, so the proof travels with the artifact.
A record you can’t prove is a record you can’t defend. Provenance makes tamper-evidence a property of the storage layer, not a policy someone remembered to follow.
What an auditor asks first.
How is Provenance different from Compliance?
Which packages does the bundle compose?
Can a third party verify a signature without my keys?
Prove fit in week one.
Don't take the fit on faith, scaffold the audited base and run it on your own stack before you commit.
The deadliest question in a build-vs-buy call is whether it fits the stack you already run. Answer it with code, not a sales call: scaffold the audited base in one command and deploy from the template the generator emits for your host. You own the source from the first line, so a week-one spike is a real evaluation on your own infrastructure — not a demo that disappears.
$ bunx @caisson-sh/cli@latest my-app $ cd my-app $ bun install # ready to run — deploy from the Railway, Fly, or Vercel template
Own the source, or take a single primitive.
A one-time, perpetual license over all three primitives, composed on the same audited base. Take a single primitive à la carte from the module catalog, or step up to Compliance, which composes Provenance plus fail-closed RLS, the evidence-pack generator, and the framework mappings.