Audit logging

Immutable audit trail

The audit table is protected by a database-level immutability trigger. The trigger rejects any UPDATE or DELETE statement targeting audit records, regardless of the identity of the database user. ON DELETE RESTRICT constraints prevent referenced records from being deleted while audit entries reference them.

Application-level write permissions to the audit table are INSERT-only. No code path in the application holds UPDATE or DELETE permissions on this table.

Events captured

• —Authentication — successful and failed login attempts, session creation and termination
• —Authorization — access grants and denials for protected resources
• —Privilege changes — role assignments, permission elevations, and removals
• —Data access — reads of records marked sensitive by the data-classification policy
• —Data modification — all record writes, updates, and logical deletes
• —Administrative actions — configuration changes, user provisioning, and key-management operations
• —Export events — every bulk-export request and the identity of the requesting user
• —Security events — rate-limit triggers, WAF blocks, and anomaly detections

Retention

Audit records are retained for a minimum of seven years. Records within the active retention window are stored in primary database storage. Records older than two years are archived to object storage, where they are encrypted at rest and protected by object-level versioning that prevents silent overwrites.

Archived records remain queryable through the platform's export interface. Retention counts begin from the event timestamp, not the archival date.

Hash manifests and export verification

Every bulk export includes a hash manifest file (manifest.sha256) listing the SHA-256 digest of each exported file. The manifest itself is signed with a platform signing key.

To verify an export:

1. Compute the SHA-256 digest of each file in the export package.
2. Compare the computed digest against the corresponding entry in manifest.sha256.
3. A mismatch on any file indicates the file was modified after export.
4. Verify the manifest signature against the platform's published public key, available at the security architecture page.