Underneath
An audit log an administrator can edit is a log of what somebody wanted you to see.
Most products treat it as a table like any other. Which means the person best placed to do something worth hiding is also the person who can remove the record of it — and no review can distinguish a clean trail from a tidied one.
Append only
Enforced where the application cannot reach around it.
Any attempt to change or remove an entry is rejected by the database itself, and the application holds no permission that would let it try. Even the retention sweep cannot remove one.
Which is the difference between a policy and a property. A policy is what people intend; a property is what the system permits.
- Entries carry who, from where, and what changed —
With the before and the after, and a marking for entries that touch personal data.
- And when we act inside your workspace, both names —
The user acted as, and the person from our side behind it — in your trail, not only in ours.
- An evidence bundle is one action —
A period, and a package of governance reports with a manifest. A report that fails is recorded as having failed rather than failing the bundle.
- Reports can be scheduled and saved as layouts —
So a recurring compliance obligation is a setting rather than a diary entry.
Support access
Two keys, a short window, and any of your administrators can end it.
A written justification at real length. Approval by colleagues who are not the requester, who cannot approve twice. A short approval window and a shorter access window. And revocation available immediately — as a kill switch for a session that should not be running.
Every step of it is written to your audit trail. And an impersonation session is capped to whatever remains of the approved window rather than outliving it.
The honest caveat: the setting that requires this before impersonation ships switched off, with a note saying to switch it on in production. Ask us to confirm it is on for your workspace. It is the sort of default that should be the other way round, and saying so here is better than not.
›Are reads recorded?
Changes are, thoroughly. Reads generally are not — with named exceptions where a sensitive value is revealed, which are recorded individually. If access logging is part of your obligations, treat this as a gap to discuss rather than a feature to assume.
›What happens when audit retention expires?
Nothing is removed, because nothing can be. That is worth knowing in both directions: it is a strong guarantee, and it means audit volume grows.
›How is our workspace kept separate?
As a condition on every row, set per request, enforced by the database — not as a filter each query has to remember to include.
›Is there a public trust page?
Yes, per workspace — showing consent purposes, sub-processors and the data agreement, and deliberately withholding the things that would let somebody enumerate what they should not.