I remember watching a talk about apache Samza [1] that tries to envision a database model that would be truly append only. It is based on Apache Kafka, so it would satisfy your &quot;distributed&quot; and &quot;immutable forever&quot; requirements.<p>Talk was really interesting, I haven&#x27;t used it yet, so I am not sure how mature for use as the canonical data-store it is.<p>As my college professor would put it &quot;I don&#x27;t thing these have found their Ulman yet.&quot; and if you look at companies using it now [2] it seems mostly stream-processing&#x2F;data-analytics.<p>Another thing is, I really don&#x27;t know how Kafka handles checking of the data authenticity, because in my mind there is not that big of a difference between malicious alteration and malicious append.<p>Because if you then use something like CRDT [3], or DDD style agregates [4] on top of your immutable data , your end users would still see their view on data mutate.<p>The thing the immutability would mostly give you is log of all the changes and simple way to restore it. And most mutable databases give you that capability as well.<p>[1] <a href="http:&#x2F;&#x2F;www.confluent.io&#x2F;blog&#x2F;turning-the-database-inside-out-with-apache-samza&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.confluent.io&#x2F;blog&#x2F;turning-the-database-inside-out...</a>
[2] <a href="https:&#x2F;&#x2F;cwiki.apache.org&#x2F;confluence&#x2F;display&#x2F;SAMZA&#x2F;Powered+By" rel="nofollow">https:&#x2F;&#x2F;cwiki.apache.org&#x2F;confluence&#x2F;display&#x2F;SAMZA&#x2F;Powered+By</a>
[3] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Conflict-free_replicated_data_type" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Conflict-free_replicated_data_...</a>
[4] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain-driven_design#Building_blocks" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain-driven_design#Building_...</a>