Product · Audit & Integrity

Prove every reading. Trust no black box.

Sentrel hash-chains every stored reading and every config change into a tamper-evident, WORM-style record aligned with 21 CFR Part 11 — so you can verify your data wasn't altered instead of taking the system's word for it.

Audit & Integrity
1

The problem: OT data you can't actually prove

Most monitoring stacks ask you to trust a database you can silently edit. A row can be backdated, a value nudged, a deletion left untraced — and nothing in the system would object. When an auditor, a customer, or your own quality team asks 'how do you know this reading is real and unchanged?', 'it's in the database' is not an answer. Historians like AVEVA PI lock the proof inside enterprise tooling; a DIY Influx + Grafana stack has no integrity layer at all; and editable spreadsheets are worse. The result is the OT black-box distrust that stalls deployments in regulated and high-liability environments.

  • Records that can be edited or deleted with no trace
  • No way to demonstrate a value is original and unchanged
  • Compliance evidence scattered across logs, exports, and tribal memory
  • 'Trust the database' fails the moment someone asks for proof
2

How it works in Sentrel

Every stored reading and every configuration change is sealed into a hash chain: each record carries a cryptographic hash of itself plus the prior record's hash, so the entries link in sequence. Change, reorder, or delete one and the chain math no longer adds up. A one-click Verify integrity walk re-computes the chain and either confirms it's intact or pinpoints the exact sequence number or reading ID where it broke. Records are write-once (WORM-style) — appended, never overwritten — to match the controls expected under 21 CFR Part 11 and GxP. Access is gated by role-based permissions at the module level, so the audit trail itself is admin-only.

  • Per-reading and per-config integrity hash, chained via prev_hash → hash
  • Verify integrity in one click; pinpoints the exact broken seq or reading ID
  • Full before/after diffs with changed fields on every create, update, and delete
  • Actor, timestamp, IP, and request ID captured on every entry
  • WORM-style append-only records; RBAC with module-level permissions
3

Why it beats the alternative

Other platforms make you bolt integrity on, buy an enterprise tier for it, or simply go without. Sentrel ships it as a default property of the data, not an add-on. The chain is self-verifiable — you can prove a reading is untouched without trusting our word or ours alone — and the same audit trail covers data and configuration in one searchable, exportable record. That turns a 21 CFR Part 11 or customer audit from a scramble into a single 'Verify integrity' click, and turns OT black-box distrust into evidence you can hand someone.

  • Integrity built into every reading — not a paid enterprise tier (vs. AVEVA PI)
  • Real tamper-evidence and compliance, not a DIY gap (vs. Influx + Grafana / ThingsBoard)
  • One audit trail for data and config, filterable by entity, action, and actor
  • Self-serve evidence for auditors, customers, and quality teams
Questions

Audit & Integrity, answered.

Each stored reading and configuration change is sealed with a cryptographic hash that includes the hash of the prior record, forming a linked chain. Altering, reordering, or deleting any record breaks the chain math, and the Verify integrity check flags the exact sequence number or reading ID where the break occurs.

Yes. Sentrel keeps write-once, WORM-style records and a full audit trail of every create, update, delete, and sign-in — capturing the actor, timestamp, IP, and before/after values — aligned with the controls expected under 21 CFR Part 11 and GxP.

Access is controlled by role-based permissions at the module level. The audit trail and integrity verification are admin-gated, while the underlying integrity hash protects every reading regardless of who is viewing it.

Stop integrating. Start monitoring.

Describe what you want to watch, connect the gateway you already own, and be live this afternoon — no integrator, no proprietary hardware, no six-month project.