About
Built by people who have had to answer an auditor.
Reldavi is an audit log for .NET teams — the record of who changed what, when, and what the value was before. This page is what we will not do with it.
Why this exists
It is a Thursday afternoon. Somebody from legal asks a simple question: who changed the discount on this contract, and when.
The answer should exist. There is an audit table — somebody added it three years ago, before the last audit, in a hurry. It has a ChangedBy column, a timestamp, and a JSON blob nobody has opened since it was written. You open it.
By six o'clock you know two things. The change is not in there. And you have no way to say what else is not in there, because nobody ever wrote down which tables it covers — it covers the four somebody remembered, and the application has grown a hundred more since. You are not looking at an incomplete record. You are looking at a record whose gaps are unknowable, which is a different and much worse thing, because it cannot be corrected and it cannot be relied on. It can only be apologised for.
Everybody in this industry has had that Thursday.
And it is not because anyone was careless
Writing this properly is a strange amount of work for something that produces no feature anybody asked for. It has to run inside every save without slowing one down. It must never lose an event and never invent one. It has to keep personal data out of a place personal data is not allowed to be, on the way in rather than on the way out. It has to still make sense when it is read back in four years by somebody who was not there. And none of that is visible on any roadmap, because a working audit trail looks exactly like no audit trail at all, right up until the afternoon it does not.
So it gets written last, by whoever is free, against the deadline of an audit that is already happening. Then it is thrown away at the next company and written again, badly, for the same reasons, by somebody making the same five decisions.
Reldavi is that work done once. Every change captured because it happened, not because somebody remembered the table. A capture path that would rather tell you it shed load than slow down your checkout. Personal data masked before it is buffered, not before it is displayed. And each day sealed into a hash that an auditor can verify on a machine we have never touched — because the one thing a record of accountability must not require is that you take somebody's word for it.
It is the boring, invisible, deeply unglamorous work that nobody gets promoted for. We thought somebody should do it properly, once, so that nobody has to have that Thursday again.
What we will not do
These are not values on a wall. Each one is a rule the code enforces and the test suite fails without, and each one costs something — which is how you tell it is real.
| An audit bug must never take down a payment flow | Capture runs inside your SaveChanges. It cannot block and it cannot throw: a full buffer sheds load and reports that it did, rather than waiting. The cost is that under extreme pressure Reldavi will tell you it dropped events instead of pretending it did not — which is the only honest answer, and the only one that leaves your application standing. |
| The tenant comes from the credential, never from the request | Not from a payload, a header, a query string or a form field. Every query against the store carries a tenant predicate no caller can influence, including the ones the assistant builds. It is the one thing a bug in this product could turn into somebody else's data, so it is the one thing no code path is allowed to decide twice. |
| A masked value never enters the queue, the wire or our storage | Masking happens before buffering, not before display. A product that stores the real value and hides it in the interface has not protected anything — it has moved the breach one query further away. |
| A model may choose a filter. It may never narrate a finding | Ask a question in your own words and a model turns it into a search. What you then read is the events themselves, with their ids on them. A plausible summary of things that did not happen is worse than no search at all, and in a compliance product it is worse than useless — somebody would act on it. |
| You should not have to trust us | Each day's events are sealed into a Merkle root that can be anchored to an independent timestamp authority, and an evidence pack verifies on a machine we have never touched. A vendor asking to be believed about the integrity of your records is asking for the one thing an auditor is not allowed to grant. |
How it is built
Checkable claims only. Everything here is visible from the outside.
| .NET first, not .NET too | The capture path is an Entity Framework Core interceptor, which is why it is automatic here and manual everywhere else. Node.js, Python and Go clients speak the same wire contract, and a conformance suite posts the same event from all four runtimes to a real endpoint and checks one expected row. |
| Warnings are errors, and so is a vulnerable dependency | The build fails on a compiler warning and on any package with a published advisory. Neither is suppressed anywhere in the repository. |
| Both languages, always together | Nothing ships in English and follows in Turkish. The site, the documentation and the dashboard are written in both, and a missing translation fails the build rather than falling back quietly. |
| You can run the whole thing yourself | One compose file, the same one we run. Nothing is held back as a hosted-only feature, because a compliance product a company cannot run itself is one it cannot audit either. |
| This site sets no cookies and loads nothing from anybody else | No analytics, no tag manager, no external fonts. Your IP address does not reach a third party because you read a page about data protection. It is a small thing, and it is the first thing worth checking about a company that sells this. |
Who is behind it
One person so far, and fourteen years of writing the same table by hand at five different employers.
Founder · İstanbul
The first job was at İstanbul Büyükşehir Belediyesi in 2012, which is an unusual place to start. A municipality is not a startup: the things it records are the things somebody is entitled to ask about later, and the question "who changed this, and when" is asked there by people with the standing to insist on an answer. That is a strange first lesson for a web developer and it turned out to be the whole of this product.
Then the ordinary path — an agency, then three years of ASP.NET at another, then eight months in Lower Saxony at a German engineering firm, where the same question arrived in a different language and with the weight the GDPR had just given it. Since 2020, six years as a .NET developer at a behavioural sciences institute, where the data is about people rather than about orders, and where "who saw this record" is not a feature request.
At every one of those, the same table got written. A ChangedBy column, a ChangedAt, a JSON blob for the rest, bolted on to the four entities somebody remembered — always in a hurry, always before an audit or an incident, always by whoever was free that week. It never covered everything. Nobody ever knew what it did not cover. And it was thrown away and rewritten at the next company by somebody making exactly the same decisions for exactly the same reasons.
Reldavi is that work done once, properly, by somebody who has now done the bad version five times and knows precisely which shortcuts come back. It captures every change automatically rather than the ones you remembered, it refuses to slow down or take down the save it is watching, it keeps personal data out of a place personal data must not be, and it seals each day so that what you show an auditor does not rest on anybody taking your word for it.
Where the fourteen years went
| 2020 — | DBE Davranış Bilimleri Enstitüsü .NET developer · İstanbul |
| 2018 | Elektramation E.K. Web developer · Lower Saxony, Germany |
| 2015 — 2018 | MaaMa Marketing Innovations ASP.NET developer · İstanbul |
| 2013 — 2015 | DNA360 İletişim ve Danışmanlık Web developer · İstanbul |
| 2012 — 2013 | İstanbul Büyükşehir Belediyesi Junior web developer · İstanbul |
Studied
- Kocaeli Üniversitesi — Bilgisayar Programcılığı
- Anadolu Üniversitesi — İktisat
Computer programming, and then economics — which is the study of how organisations account for themselves, and a less unrelated second degree than it sounds for somebody who ended up building this.
Talk to us
Questions about whether this fits your obligations, your architecture or your budget are answered by the person who wrote the thing you are asking about.