FIPS 140-3
OS-level CMVP-validated cryptography (NIST CMVP #5482).
Trust & Security
Built for environments where data sovereignty is non-negotiable
logrok is designed for classified, air-gapped, and regulated networks. Here is exactly what that means — every claim maps to a control you can verify in an evaluation.
Compliance & standards
DISA STIG
Hardened to Defense Information Systems Agency security benchmarks.
CIS Level 1
Center for Internet Security baseline hardening.
NIST SP 800-53
Aligned with the security controls for federal information systems.
CMMC Level 2
Supports controlled unclassified information (CUI) handling.
OCSF v1.3
Open Cybersecurity Schema for vendor-neutral detection and allied interop.
Compliance packs
Licensed DORA, NIS2 and PCI DSS packs map logrok's evidence to those frameworks: risk register, business continuity, retention posture, DORA incident classification, and a PCI DSS Requirement 10 bundle. Evidence for assessors, not a certification.
Evidence packs
Seal a search into a signed, encrypted archive anyone can verify with OpenSSL, sha256sum and zstd. A pack proves its rows have not changed since it was sealed — not since ingest.
Vendor attestation
A live in-product view of the evidence procurement and risk teams need to file logrok in a vendor register: deployment model, hardening posture, and retention.
Helps meet HIPAA and GDPR audit-logging requirements: an append-only, attributable audit trail, configurable retention, and role-based access to it.
Deployment & data sovereignty
Zero telemetry
logrok sends no usage data, crash reports or metrics to us or anyone else. Automatic update checks can be turned off.
Air-gap capable
Offline container images and offline license activation — runs with no internet path.
Your perimeter, your data
All collection, detection, and storage happen on infrastructure you control.
Sovereign to the edge
Even the agent has no phone-home
Sovereignty can't stop at the platform. LUnA, the logrok universal agent, carries a signed, offline entitlement — no vendor-portal check-in, no telemetry, no periodic licence call. Air-gap is a normal mode of operation, not a workaround.
How LUnA proves it
Security architecture
Encrypted storage
AES-256-GCM sealed-file destinations with hash-chain tamper evidence.
Strong authentication
MFA / SSO via FIDO2, YubiKey, Passkeys, and CAC/PIV smart cards.
Tamper-evident audit
Append-only, hash-chained audit trail of significant platform actions, attributable per user.
Access control
Role-based access control (Casbin) with fine-grained resource permissions.
Tenant isolation
Defense-in-depth multi-tenant isolation enforced by database row-level security.
Encrypted secrets
Credentials and integration secrets live in an encrypted, tenant-scoped secrets store; a saved value is never shown again.
Roles that match the work
Five built-in roles. The auditor role is read-only on governance records with no access to log content; the compliance officer role owns those records. A user with several roles gets all of their permissions.
Least-privilege database
Every database account has a random password, log ingest does not run as an administrator, and logrok's services can touch only logrok's own log database.
Trusted agents
Agents enroll with one-time tokens, can be required to present per-agent client certificates (mTLS), and install only signed, checksum-verified upgrades.
Responsible disclosure
Found a security issue? Email [email protected] with details and we'll respond promptly. We appreciate coordinated disclosure.