Audit log

Every sensitive action writes an audit entry. Entries are immutable, tamper-evident, and searchable.

What's logged

• Authentications: logins, failures, MFA events, password resets.
• Permission changes: role grants / revocations, scope changes.
• Data changes: create / edit / delete on core records (shipment, invoice, payment, rate card).
• Financial actions: post, void, regenerate, write-off, FX revaluation.
• Exports: CSV / report downloads.
• Admin actions: tenant settings, integrations, template publish.
• Portal actions: customer views, downloads, acknowledgements, e-signs.
• API calls: all state-changing calls.

Entry content

• Actor: user or system / integration.
• Timestamp (UTC).
• Action.
• Target record (id + type).
• Before / after values on edits.
• Source IP + device fingerprint.
• Tenant id, entity id.
• Session id.

Immutability

Entries cannot be edited or deleted, even by TENANT_ADMIN. Backend writes are append-only. Tamper-evidence via rolling hash chain (each entry hashes the prior entry).

Retention

• Default: 7 years.
• Configurable per tenant / per jurisdiction.
• Legal holds pause auto-expiry on specific entries.

Access

• COMPLIANCE role reads all.
• TENANT_ADMIN reads all.
• Regular users see their own actions only.
• Customer portal users see their own portal actions.

Querying

• UI at /app/admin/audit-log — filter by actor, target, action, timeframe.
• CSV export (logged as its own audit entry).
• Read-only API for SIEM ingest.

SIEM integration

Stream audit events to your SIEM (Splunk, Sumo, Elastic, Datadog) via:

• Webhook per event.
• Bulk fetch API (paginated, incremental).
• S3 / blob export nightly.

Use cases

• Forensics — "who changed this invoice in the last 30 days?"
• Access reviews — who has what role, when did it change.
• Regulator requests — produce a time-boxed export.
• Incident response — correlate user sessions to suspicious events.

What's NOT in the audit log

• Read-only views of data (not audited by default; too noisy). Opt-in per resource type for sensitive records (e.g. high-value invoices).
• Internal system housekeeping (schema migrations, scheduled jobs).

Clock skew

All timestamps normalised to UTC at the server. Device timestamps recorded as metadata where available; never authoritative.