AnchorLog Datasheet

Overview

AnchorLog is an on-premises log-management platform that collects, parses and stores network and security logs with a cryptographic chain of evidence. Each log batch is hashed with SHA-256, chained to the previous batch and timestamped by an RFC 3161 Time Stamping Authority. The result is an independently verifiable, tamper-evident archive suitable for court proceedings, regulatory audits and insurance claims.

Key Capabilities

AnchorLog combines high-performance log ingestion with legally defensible integrity guarantees.

• Built-in FortiGate syslog parser with automatic field extraction
• SHA-256 hash chain linking every log batch to its predecessor
• RFC 3161 TSA timestamps from a qualified trust-service provider
• Cosign-based signature verification for independent audit
• Full-text search and filtered views across all log sources
• Configurable retention policies aligned with Law 5651 and KVKK
• REST API for programmatic log submission and query

Evidence Chain

When a log batch is sealed, AnchorLog computes a SHA-256 digest over the batch contents and the previous chain hash. This digest is submitted to an RFC 3161 TSA, which returns a signed timestamp token proving the data existed at that point in time. The token and hash are stored alongside the logs. Any modification to a sealed batch breaks the chain and is immediately detectable during verification.

Deployment

AnchorLog runs entirely on-premises — on the Edge appliance, a dedicated VM or bare-metal server. It receives logs over syslog (UDP/TCP/TLS) and REST. Storage uses encrypted volumes (LUKS) with configurable rotation. No data leaves your network; the only external call is the optional RFC 3161 TSA request, which sends only the hash — never the log content.

Compliance

AnchorLog satisfies the log-retention and integrity requirements of Turkish Law 5651, KVKK and ISO 27001 A.8.15. The hash chain and TSA tokens provide non-repudiation evidence accepted by Turkish courts and the BTK. Retention periods are configurable per source, with automatic secure deletion after expiry.