The transparency log — what we sign, and why

Most software vendors say “trust us” and ship a signed binary. We ship a signed binary, and also a public ledger of everything we’ve ever done to your engine.

What’s in the log

Every event the license server emits — activations, renewals, updates pushed to your engine, config changes, audit-export requests — gets hash-chained into a Merkle tree, with the root signed and published hourly. Anyone with the public verification key can fetch the latest root, walk the chain, and confirm:

• The activation event your engine received was the one we issued
• No event was retroactively edited or deleted
• The update binary you received matches the one we attested to

Why a tree, not a log

A linear log lets us claim “no events were dropped.” A Merkle tree lets you prove it. If we removed an event, the tree’s root hash changes, and every previous signed root we published would be invalidated. Auditors who care about non-repudiation get math instead of policy.

What you can do with it

• At install time, your engine fetches the published root and verifies its activation against the tree. If we tried to issue a fake license, the engine catches it before serving traffic.
• At any time, run vloud audit verify --since=YYYY-MM-DD and the engine cross-checks every event in its local audit log against the public tree.
• At compliance time, export the tree’s signed roots for the audit window. They’re independently verifiable by any third party with our public key.

What we sign

• License events (issued, renewed, revoked, expired)
• Update manifests (binary hash + version + signing time)
• Mirror bundles (offline-mode signed packages)
• Operator config changes pushed via the staff console
• Audit-export confirmations

What we explicitly don’t sign or log: customer data. The contents of your databases, files, requests, environment variables — none of that lives on the staff side, so none of it ends up in the transparency log either.

Trust through math. The fourth value on our list, and the one that turned the fifth (calm by default) from a marketing line into an engineering invariant.