PhotonPeak

Every admin action across your SaaS stack, kept as evidence.

PhotonPeak pulls administrator audit logs from Microsoft 365, Google Workspace, Okta, GitHub and AWS CloudTrail with read-only access. Each event is normalized, sealed in a SHA-256 hash chain and retained for up to seven years, so you can answer an auditor or an incident question with a search instead of a week of exports.

See pricing How it works
Illustrative product interface

Six sources in, one sealed record out

PhotonPeak sits between the systems your admins touch and the places your evidence needs to go. It only reads. It never creates users, changes roles or edits settings in a connected tenant.

  • Microsoft 365

    Unified Audit Log via Management Activity API

  • Google Workspace

    Admin SDK Reports API

  • Okta

    System Log API

  • GitHub

    Enterprise audit log streaming

  • AWS

    CloudTrail trail delivered to S3

  • Your apps

    HTTPS events endpoint, JSON

PhotonPeak

  1. 1 Normalize to one event schema: actor, action, target, time, source IP
  2. 2 Seal: each event's SHA-256 hash includes the previous one
  3. 3 Retain in write-once storage for 1, 3 or up to 7 years

  • Your S3 bucket

    Nightly JSON Lines export

  • Your SIEM

    Splunk HEC or Microsoft Sentinel forwarding

  • Auditor workspace

    Read-only, time-limited access

Pull, not push. We poll each vendor's audit API on a schedule (every 5 minutes for Okta and GitHub, every 15 for Microsoft 365 and Google Workspace) using a read-only service account or app registration you approve.

Raw is kept. The original vendor JSON is stored next to the normalized record, so an auditor can always see exactly what Microsoft or Google returned.

Out on your terms. Forward to your SIEM in near real time, export to your own S3 bucket, or give an auditor a scoped login that expires on the date you set.

Connected in an afternoon

  1. 01

    Grant read-only access

    Approve the PhotonPeak app in Microsoft Entra ID and Google Workspace, create a read-only Okta API token, install the GitHub App and point an IAM role at your CloudTrail bucket.

  2. 02

    Choose retention and rules

    Set how long each source is kept and switch on the starter rules: new privileged role, MFA disabled, logging stopped, external sharing turned on.

  3. 03

    Send your own events

    Internal admin panels can post JSON to the events endpoint with a scoped ingest key. Those events are sealed in the same chain as everything else.

send-event.sh

curl -X POST https://ingest.photonpeak.online/v1/events \
  -H "Authorization: Bearer $PHOTONPEAK_INGEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "billing-admin",
    "actor": "ops-admin@yourco.com",
    "action": "refund.limit.changed",
    "target": "workspace/finance",
    "occurred_at": "2026-10-27T16:42:05Z",
    "detail": { "from": 500, "to": 2500, "currency": "USD" }
  }'

What you get

  • One event schema

    Actor, action, target, source IP, user agent and outcome mapped the same way for every vendor.

  • SHA-256 hash chain

    Any edited or deleted event breaks the chain; run verification from the app or the CLI.

  • Search in seconds

    Filter by person, action, source or date range across years of history.

  • Evidence packs

    Bundle a query as CSV, JSON Lines and a signed PDF summary with chain checkpoints.

  • Detection rules

    Email or webhook alerts when privileged roles, MFA or logging settings change.

  • SIEM forwarding

    Stream normalized events to Splunk HTTP Event Collector or Microsoft Sentinel.

  • Auditor seats

    Read-only logins scoped to selected sources and dates, with automatic expiry.

  • Raw payload kept

    The original vendor JSON stays attached to every normalized record.

How we handle your logs

Audit logs contain names, emails and IP addresses. We treat them that way.

Encryption
TLS 1.2+ in transit, AES-256 at rest. Vendor credentials are stored encrypted and never shown again after setup.
Least privilege
We request read-only audit scopes only. No write permission is asked for in any connected tenant.
Export and deletion
Export everything as JSON Lines at any time. When you close the account, data is deleted within 30 days and we confirm by email.
Support response
Email replies within one business day on every plan; within 4 business hours for ingestion outages on Growth and Enterprise.

Questions

Does PhotonPeak change anything in my tenants?

No. Every connector uses read-only audit scopes. PhotonPeak cannot create accounts, assign roles or edit settings in Microsoft 365, Google Workspace, Okta, GitHub or AWS.

How far back can you import?

As far back as each vendor keeps it. Microsoft 365 and Google Workspace usually hold 180 days or less depending on license, so we recommend connecting before you need the history.

What counts toward the monthly GB?

The uncompressed size of the event JSON we ingest. Searches, exports, rule alerts and auditor seats are not billed.

How do I prove the logs were not edited?

Each event's hash includes the previous event's hash. Daily checkpoints are written into every evidence pack, and the verify command recomputes the chain from your export.

Can we keep data in our own storage too?

Yes. Nightly JSON Lines exports can be written to an S3 bucket you own, in addition to PhotonPeak retention.

Is PhotonPeak a SIEM?

No. It is a retention and evidence layer. Teams with Splunk or Microsoft Sentinel forward events there for correlation and keep PhotonPeak as the long-term record.

Start collecting before the auditor asks.

14-day trial on the Starter plan with up to 5 GB of ingestion. No card needed.

Request a trial