Skip to main content
ProvenLog operates in two modes. Both provide the same hash-chained audit trail — the difference is where events are stored and how they’re accessed.

Embedded mode (default)

The SDK writes events directly to a local SQLite database. No server, no network, no infrastructure.
Characteristics:
  • Zero setup — works immediately after pip install provenlog
  • Hash chain computed in-process
  • Database at ~/.provenlog/events.db (configurable)
  • No network dependency
  • Per-process isolation
Best for: Development, single-agent deployments, CI/CD pipelines, getting started.

Server mode

The SDK sends events to a plog serve instance via HTTP. The server coordinates hash chains, aggregates events from multiple agents, and serves the web dashboard.
Characteristics:
  • Multi-agent aggregation on a single server
  • Web dashboard at the server URL
  • WebSocket live streaming
  • REST API for queries and verification
  • Server-authoritative hash chain sequencing
  • Optional API key authentication
Best for: Production, multi-agent systems, team visibility, compliance workflows.

Choosing a mode

Switching modes

Switching is a one-line change — pass a URL to enable server mode, or omit it for embedded:
You can also control the mode via environment variables: