Every tool you're running was built to answer: what's happening now. None were built to answer: what happened, and can you prove it.
REC. 1.1 — SCANNER OUTPUT
Last scan results
dr-smith-laptop47 days ago
reception-pc-0112 days ago
lab-workstation-a61 days ago
192.168.1.47unknown
Next scan scheduled: 13 days
Snapshots expire the moment they're taken.
Scanners tell you what existed at the last scan. Networks change constantly. By the time an auditor asks, the record is already stale.
REC. 1.2 — REVIRA LEDGER
Evidence · Live
dr-smith-laptop · approved0s ago
reception-pc-01 · observed14s ago
lab-workstation-a · verified31s ago
00:1A:2B · pending review58s ago
Every event. As it happens.
Revira doesn't wait for a scan. Every device observation is recorded the moment it occurs. The record is always current.
Why local-first is not optional
Your data stays on your network.
Compliance data is not operational telemetry. It is evidence. The entity responsible for that evidence must control where it resides.
REC. 2.1 — CLOUD-DEPENDENT TOOL
Outbound connections
↑compliance-cloud.vendor.io2.4 MB
↑telemetry.saas-platform.com880 KB
↑logs.external-siem.net1.1 MB
↑audit.cloud-backup.io640 KB
Someone else holds your evidence.
When compliance data transits outside your network, chain of custody becomes difficult to establish and harder to defend in front of auditors.
REC. 2.2 — REVIRA
0
Outbound connections
All compliance data stays on-premise
Zero outbound. Full custody.
Revira performs no outbound telemetry. Your compliance record never leaves your network. Fully air-gap capable.
The architectural divide
Every tool keeps logs. Revira keeps the record.
Operational tools generate history as a side effect of their primary job. Revira is built so the historical record itself is the canonical source of truth.
REC. 3.1 — OPERATIONAL TOOLS
Operational stack
RMMcurrent state
Scannerlast interval
SIEMrecent events
Compliancepolicy status
history retained as logs, not as canonical record
History as exhaust.
RMMs, scanners, SIEMs, and compliance platforms all retain logs. None are architected so the historical record is canonical. When a device is reimaged or an attribute changes, history fragments across rows, vendor schemas, and retention policies. Reconstructing what happened on a specific date means assembling fragments after the fact.
REC. 3.2 — REVIRA
Revira ledger
identitypersistent
timelineappend-only
observationcontinuous
integrityhash-chained
history is the canonical record
History as the canonical record.
The ledger is the source of truth. Every event is hash-chained and append-only. Identity persists across attribute changes by design, not by reconstruction. The record exists in the form an auditor needs before an auditor asks.
Why reconstruction persists
Reconstruction works. That is the problem.
Because it works at significant cost, there is no forcing function to replace it. The pain is attributed to staff, not to the architecture requiring it.
REC. 4.1 — QUARTERLY RECONSTRUCTION
Q1 Device Inventory.xlsx
DeviceFirst seenStatus
dr-smith-laptop—filling...
reception-pc-01Jan 12—
lab-workstation-aunknown?
192.168.1.47——
40+ hours. Every quarter. Same spreadsheet.
Manual reconstruction from DHCP logs, RMM exports, and staff interviews. Then repeat next quarter.
REC. 4.2 — REVIRA AUDIT QUERY
Audit Query
What devices were on the network Jan 1–Mar 31?
← 1.1s
28 devices · 26 approved · 2 pending · 0 gaps
no reconstruction required
Same question. Answered in seconds.
The record already exists. Revira queries it directly. What took weeks returns in under 60 seconds.
The canonical claim
The device stays the same device.
MAC changes. Hostname changes. Interface swaps. Revira correlates available signals to maintain a single continuous identity. The record does not reset when attributes do.
REC. 5.1 — CANONICAL IDENTITY
Canonical identity
identity persists across every attribute change
Identity persists across every attribute change.
A laptop reimaged, MAC swapped, hostname renamed, network interface changed. Revira correlates available signals to maintain a single continuous identity. The chain never breaks.
The gap is architectural. The solution is infrastructure.
Revira is the evidentiary layer your stack was never built to maintain.