Datadog is a great observability platform
We mean this genuinely. If you need distributed tracing, APM, infrastructure monitoring, or log aggregation for debugging production issues, Datadog is excellent. Many teams use Datadog and unTamper — they're complementary.
But Datadog's audit trail features are designed for a different job than unTamper's.
What Datadog's audit trail is designed for
Datadog's Audit Trail logs actions within the Datadog platform itself: who changed a dashboard, who created an alert, who modified a configuration. It's an internal audit log for Datadog administrators.
For application-level events — what your users, admins, or AI agents did in your product — Datadog's log ingestion can capture them, but it has no concept of:
- Cryptographic hash chaining across events
- Independent verification without Datadog access
- Structured typed events with first-class actor/action/target semantics
- Chain-level tamper detection
Not a Datadog criticism
This isn't a design flaw in Datadog — it's a focus difference. Datadog is built for operational observability at scale. unTamper is built for provable audit integrity for high-stakes events. These are different jobs.
Feature comparison
| Feature | unTamper | Datadog Log Management |
|---|---|---|
| Cryptographic hash chaining | ||
| Independent chain verification | ||
| Export with verification proof | ||
| Typed actor/action/target schema | ||
| Full-text search | ||
| Custom metadata filtering | ||
| Tamper detection | ||
| Auditor access without credentials | ||
| Purpose-built for audit events | ||
| Infrastructure observability | ||
| APM / distributed tracing |
The trust model difference
When you store audit events in Datadog, the integrity of those events depends on Datadog's infrastructure security and your own access controls. If someone with Datadog admin access wanted to delete or modify log entries, they could.
Datadog does not expose a public verification API that lets an auditor confirm that a set of log entries hasn't been altered. The trust model is: "Datadog is a secure SaaS, and we trust our access controls."
unTamper's trust model is different: the chain is verifiable by anyone with the data. You don't have to trust unTamper, or your own access controls. You verify mathematically.
When to use which
Use Datadog for:
- Application performance monitoring and distributed tracing
- Infrastructure metrics and dashboards
- General-purpose log aggregation for debugging
- Alerting on operational anomalies
Use unTamper for:
- Admin action audit trails that need to be defensible under scrutiny
- Compliance-critical event logging where tamper evidence is required
- Any event where you need to be able to say "this record is provably unaltered"
- Events your enterprise customers or auditors need to independently verify
Many teams use both. Datadog sees everything. unTamper makes the critical 1% provable.