Change evidence for everything you run

Prove every production change before the auditor asks.

Stonewake records each change to your clusters, cloud accounts, pipelines and databases at the moment it is made, checks it against your policies, and seals the result into a tamper-evident evidence pack. When an auditor samples a change, you send a link instead of losing a week.

Run the live demo See a sample evidence pack

Runs in your environment. No SaaS, no data leaves.
Connects in minutes. Starts in record-only mode.
Free for one source. No sales call needed.

Change decisions · all sources Sample data

Ledger head sha256:… chain verified

The problem

One sampled change. Four systems. Half a day.

Auditors do not test your dashboard. They pick individual changes and ask what happened to each one. Today someone on your team rebuilds that answer by hand, for every system the change touched.

Audit logswho sent what, when
Change ticketswhat was approved
Scanner exportswhich CVEs, at which time
Access recordswho was allowed to

One evidence pack sealed at decision time, verifiable forever

4 hDORA: first notice after a major incident is classified

24 hNIS2: early warning after you become aware of a significant incident

72 hGDPR: breach notification to the regulator

Reporting clocks now run in hours. Evidence that takes days to assemble arrives too late.

Live demo · runs in your browser

Ship a change. Watch the evidence build itself.

Pick a change and apply it. The digests below are real SHA-256 hashes computed on this page, and each pack is chained to the one before it. Then try to tamper with one.

1. Choose a change

prod-east-2

Captured at the control pointRequester, operation and full object recorded.
Change digest computedSHA-256 of the submitted object.
Policies evaluated14 policies, frozen at decision time.
DecisionWaiting for a change.
Pack sealed and chainedLinked to the previous pack's digest.

Evidence pack ep-000000

ALLOW

Pack verified

Coverage

One ledger for every place change happens.

A production change rarely stays in one system. The same release touches a pipeline, a cluster, a cloud account and a database. Stonewake gates each of them and links the records into one story.

k8s

Kubernetes

Every create, update and delete at admission, on any conformant distribution.

cloud

Cloud and Terraform

Plans and applies for AWS, Azure and Google Cloud, plus console changes made outside code.

ci/cd

Pipelines and Git

Merges, deployments and protected-branch overrides in GitHub, GitLab and Argo CD.

data

Databases

Schema migrations and privileged statements on PostgreSQL and MySQL.

identity

Identity and SaaS

Role grants, policy edits and admin actions in Okta, Entra ID and your Git organisation.

agents

AI agents

Tool calls that change production, recorded with the agent, the model run and the human behind it.

The platform

Built for how changes ship now.

Pipelines, infrastructure-as-code and AI agents now make most production changes. Stonewake treats each of them as an accountable actor and keeps proof you can hand to someone outside your team.

A ledger nobody can quietly edit

Every pack carries the digest of the pack before it. Change one field in one record and every later digest stops matching. Ledger heads are signed on a schedule and can be anchored to storage you control, such as an object-lock bucket.

append-only · hash-chained · signed heads

Approvals bound to the exact change

Risky change? The approver gets it in Slack, Teams or ServiceNow with the diff and the finding. The signed token covers that one digest and expires in four hours. Change one line and it needs a new approval.

Ed25519 · digest-bound · expiring

AI agents on the record

When an agent or a pipeline makes the change, the pack names the workload identity, the human who delegated it and the run that triggered it. "The bot did it" stops being the end of the trail.

SPIFFE · OIDC · delegation chain

Waivers that expire by design

Exceptions need an owner, a scope, a reason and an end date of 90 days or less. Owners are reminded before expiry. Nothing stays waived forever because someone forgot.

scoped · justified · 90-day max

Runtime evidence, same pack

Collectors record what a workload does after the change lands: processes and connections on nodes and hosts, drift on cloud resources. A shell in production or an unexpected outbound connection is attached to the change that shipped it.

eBPF · drift detection · no sidecars

The Auditor Room

Give your auditor a read-only, time-boxed view of the sampled population. They pick the changes, open each pack and verify the digests themselves. No screenshots, no spreadsheet exports.

read-only · time-boxed · self-verify

Signatures ready for the next decade

Audit records outlive the cryptography that signed them. Packs can carry a hybrid signature that pairs Ed25519 with ML-DSA (FIPS 204), so evidence sealed today still verifies after classical signatures are retired.

Ed25519 + ML-DSA-65 · crypto-agile

Three ways teams handle change evidence

What the auditor needs	Manual assembly	Policy engine alone	Stonewake
Record of every change, not only violations	Partial, from logs	No	Yes
Proof the record was not altered	No	No	Hash chain + signature
Approval tied to the exact object	Ticket number only	No	Digest-bound token
Agent and pipeline identity	Service account name	Service account name	Full delegation chain
Mapped to control IDs	By hand, per audit	No	In every pack
Time to answer one sample	Hours	Hours	Seconds

Rollout

Observe first. Enforce when you trust it.

Week 1
Record

Every change from every connected source is captured and packed. Nothing is blocked and nobody's deploy slows down. You see what your policies would have caught.
Week 2–4
Advise

Engineers get a warning on risky changes at apply time, with the reason and the fix. Outcomes are recorded. Still no blocking.
When ready
Enforce

Policy by policy, changes above your threshold need an approval token or an active waiver. Everything else passes untouched.

Connect a source

One command per source. Every gate fails open by default, so a Stonewake outage never stops a deploy.

stonewake connect kubernetes --context prod-east-2 --mode record
stonewake connect aws --org o-example --mode record
stonewake connect github --org your-org --mode record
stonewake connect postgres --host ledger-db.internal --mode record

Frameworks

Mapped to the controls you are tested on.

Choose your framework to see which controls a pack answers and what the auditor receives.

What it is worth

Count the hours you get back.

Move the sliders to match your audits. The estimate assumes about two minutes of review per sampled change once packs exist.

Changes sampled per audit 60 Hours to assemble evidence per change 4 Audits and assessments per year 3 Loaded cost per engineer hour $110

Engineer time returned each year

696 hours

Today720 h

With Stonewake24 h

Cost avoided per year: $76,560
Equivalent working weeks: 17.4

An estimate from your inputs, not a guarantee.

Pricing

Published prices. Start without talking to us.

Priced per connected source: a cluster, a cloud account, a pipeline organisation or a database. No charge per node, per record or per pack.

Community

For trying it on a real system.

1 source of any type
Record mode
Evidence packs with hash chain
30 days of history
JSON and PDF export

Install now

Most teams start here

Team

$1,200per source / month, billed yearly

For passing an audit this year.

Everything in Community
Advise and Enforce modes
Approvals in Slack, Teams, ServiceNow, Jira
Waivers with expiry
Control mapping and the Auditor Room
Unlimited history

Start a 30-day pilot

Enterprise

Custom

For regulated and air-gapped estates.

Everything in Team
Air-gapped install and offline updates
Hybrid post-quantum signatures
Runtime and drift evidence
SSO, custom control catalogs
Named engineer and 1-hour response

Talk to an engineer

The pilot promise. Bring one evidence request from your last audit. If Stonewake cannot answer it from a live system within 30 days, you pay nothing and keep the Community tier.

Our own security

We hold ourselves to what we sell.

Your data stays yours

The control plane, the ledger and the collectors all run in your environment. There is no Stonewake cloud to breach and no telemetry unless you switch it on.

A supply chain you can check

Every release ships with a signed image, an SBOM and build provenance. Verify them before anything touches your environment.

Least privilege by default

Connectors start read-only and see change requests and nothing else. Enforcement permissions are added per source, only when you enable enforcement.

This site, too

No trackers, no cookies and no third-party scripts or fonts. A strict content security policy blocks anything not served from this origin. Open your browser's network tab and check.

Found a vulnerability? See security.txt for how to report it.

Questions

What buyers ask first.

Will it slow down or block our deploys?

Not unless you ask it to. Record mode adds a check measured in milliseconds and never rejects a request. Every gate fails open, so if Stonewake is down your deploys continue and the gap itself is recorded.

We already run OPA, Sentinel or Kyverno. Do we replace it?

No. Keep your policy engine. Stonewake records its verdicts alongside its own and turns them into evidence. Policy engines decide; they do not keep a per-change record an auditor can verify.

What does the auditor actually receive?

A pack per sampled change as PDF and JSON, or a read-only Auditor Room link. Each pack states what changed, who requested it, which policies ran, who approved it, which waivers applied and which control IDs it supports. Open the sample.

What can it connect to?

Kubernetes 1.27 or later on any conformant distribution, AWS, Azure and Google Cloud, Terraform and OpenTofu, GitHub, GitLab and Argo CD, PostgreSQL and MySQL, Okta and Entra ID, and AI agents through a tool-call gateway. Air-gapped installs are supported on the Enterprise plan.

How long does a rollout take?

The first source is typically recording within an afternoon. Most teams stay in Record mode for a week or two, then turn on advisories, then enforce a handful of policies.

Can someone with database access rewrite history?

They can change bytes, but they cannot hide it. Every pack includes the previous pack's digest and ledger heads are signed, so any edit breaks verification for every later record. The demo above shows exactly that.

Get started

Bring your hardest evidence request.

In 30 minutes we connect Stonewake to one of your systems with you, ship a change and answer the request live. If it does not fit, you will know before the call ends.

An engineer, not a pitch. You talk to someone who runs it.
Your template. We map packs to your auditor's request list.
No lock-in. Packs are plain JSON you can verify without us.