A log you can check, not just read
Crunu records what happens in your organization as a chain of hashes. If an entry in the middle is changed, removed or inserted, the integrity check shows it. Values never appear in the log, because the server doesn’t know them.
- Verify integrity in one click
- Export JSONL to check it elsewhere
- Kept 365 days by default, or longer
Who, what, when and from where
The log covers sign-ins, devices, invitations, roles, versions, key rotations, machines, tokens, share links, denials and network policy changes. Filter it by person, action, environment or period.
- Linked by hashesEach entry is linked to the one before it. Verify integrity runs the check, Export JSONL hands you the file to check outside Crunu.
- Your own account logEvents outside any organization, such as deleting one or recovering access with a recovery code, go to your account’s log.
- No values, everThe server doesn’t know your values, so they can’t reach the log or alerts.
Showing and copying, signed by the person
Showing, copying or exporting a value happens on the device, so the app records it and signs it with the person’s key. These entries carry a Client-reported label.
- The fetch log behind every reportThe server remembers who received which versions, when, how many times and from which address. The offboarding report is built from it.
- Signed, then markedA modified app could leave out an event, which is why client entries are labeled as reported by the client.
- Find it laterFilter by person, action, environment or period.
Alerts where your team already looks
An alert feed in the organization counts repeats. Send alerts to a webhook signed with HMAC, which works with incoming webhooks of Slack, Microsoft Teams or PagerDuty, or to email.
- What raises an alertA new device, an enrollment code used twice, a machine at a new address, a replayed CI token, a series of denials, an expired lease, recovery with a code, expiring certificates, undelivered keys and seven network alerts.
- Severity and a testPick a severity threshold for each channel and send a test message to check it.
- One status pageMachines online, the key queue, open alerts, expiring certificates and the last log check, on one page.
Kept as long as you need
Entries are kept 365 days by default. An organization can only extend that, and trimming leaves a checkpoint, so the chain can still be verified in full.
| Setting | Value |
|---|---|
| Default retention | 365 days |
| Who can change it | The organization, and only to keep longer |
| Longest | Up to 36,500 days, or no limit |
| After trimming | A checkpoint stays, so the chain verifies in full |
What a log can and can’t prove
The chain makes edits visible. It doesn’t make the server honest about everything else.
- The log is metadataNames, addresses, times and actions are visible to the server. Values are not.
- Client-reported means just thatA modified app on someone’s device could leave out a Show or Copy event.
- It can’t stop a failing serverA hostile server can refuse service or lose records. Regular JSONL exports and backups kept elsewhere are the defense.
- Email needs emailOn a self-hosted server without email set up, only webhooks are available. There’s no built-in Slack or Telegram app.
Answers to common questions
Something else? Write to support@crunu.com
Are secret values ever written to the log?
No. The server doesn’t know them, so they can’t reach the log or alerts.
How do I prove the log wasn’t edited?
Run Verify integrity in the app, or export JSONL and check the hash chain outside Crunu.
How long are entries kept?
365 days by default. An organization can keep them longer, up to 36,500 days or with no limit, but not shorter.
Can alerts go to Slack?
Yes, through a Slack incoming webhook. Each request is signed with HMAC so your receiver can check where it came from.
Can I see who looked at a value?
Yes, when they showed, copied or exported it in the app. Those events are signed by the person and marked Client-reported.
Have the answer before anyone asks
Create an organization and the audit log starts with the first sign-in.