koigrid vs AWS CloudTrail
A built-in audit log of who did what — the zero-setup, flat-rate alternative to AWS CloudTrail.
CloudTrail is powerful but heavy: you configure trails, pay per event delivered, ship logs to an S3 bucket, and query them with Athena before you can answer "who deleted that?". koigrid gives every organization an Audit Log out of the box — a curated, filterable record of every security and config change, with the actor (user or AI agent) and their IP, plus one-click CSV export. Nothing to enable, nothing extra to pay.
| Feature | koigrid | AWS CloudTrail |
|---|---|---|
| Setup | On by default for every org | Create trails + S3 bucket + IAM |
| Actor identity | User or API-token agent, resolved + IP | IAM principal ARN |
| Query | Filter by category/action/actor/date in the UI or API | Athena / CloudTrail Lake (extra cost) |
| Export | CSV in one click (injection-safe) | S3 objects you parse yourself |
| Pricing | Included in your flat plan | Per event + S3 + Athena scans |
| Lock-in | None — open API + CSV | AWS-specific format + tooling |
What koigrid improves
Zero setup
No trails, no buckets, no IAM — every org has an audit log the moment it exists.
Agent-native
API-token actions are attributed to the agent that made them, not just "an API call" — perfect for AI-operated infra.
Answer in seconds
Filter by actor, action or date in the dashboard or API — no Athena query to write.
Frequently asked questions
Is koigrid cheaper than AWS CloudTrail?
koigrid is flat-rate with bandwidth included — no per-GB egress or per-request fees. For a comparable setup you usually pay a lot less (see the estimate above).
Can I migrate from AWS CloudTrail without lock-in?
Yes. koigrid runs on portable primitives — standard PostgreSQL, S3-compatible storage and containers — so you can move in (or out) whenever you want.
Is my data hosted in the EU?
Yes. koigrid is EU-hosted (on Hetzner) with data sovereignty by default.
Can I run everything from an API or an AI agent?
Yes — koigrid is API-first and agent-native: every action has an API and a scoped token, with llms.txt and OpenAPI so an LLM can operate it end to end.