Most audit logs record what happened. This one can also demonstrate that the record has not been edited since.
No database role holds update or delete on the audit log — not the application, not the service role, not us. Triggers refuse the statements as well, so the intent survives someone helpfully granting a privilege back later.
Those controls are worthless against exactly the actor you most need to answer for: whoever holds superuser. So each entry hashes its content onto its predecessor’s. A row rewritten behind the controls breaks the chain, and verification names the entry where it broke.
Each entry records whether the change came from a user acting under their own permissions or from the platform acting on their behalf. That distinction is the one an auditor cares about most, and it is the one most systems lose.
The control every finance team asks about first, and the one most B2B platforms leave to a spreadsheet.
Read moreTrust signals grounded in verified documents and delivered orders, not self-declared profiles.
Read moreControls that live in the database, so they apply whether the order came from the app, an integration, or someone in a hurry.
Read more