An audit log the auditor can verify without taking your word for it.
Append-only, hash-chained, verified daily. Every action across every module writes one record, and anyone holding the export can recompute the chain and see for themselves that nothing moved.
Tamper-evidence that doesn’t rest on trusting the vendor.
Append-only, enforced by the database
Entries are written once, never modified or deleted. The application's database role has UPDATE and DELETE revoked on the audit table — append-only is enforced by Postgres, not left to convention.
Hash-chained
Each entry stores a SHA-256 hash of the previous entry together with the row's own canonical contents, chained per tenant. Tampering with any record breaks the chain — detectable by anyone with the export.
Daily verification
An automated verifier checks chain integrity daily and exports chain heads. Gaps or breaks trigger alerts.
Cold export to immutable storage
Every day, the chain heads are exported to object-locked EU storage — write-once, outside the running database — so the evidence survives even if the live system is compromised.
Cross-module coverage
Incidents, changes, CMDB edits, permission changes, de-pseudonymization requests, login events — everything is logged.
Retention that meets the rule
Seven years by default, extended to ten when the MaRisk toggle is on. PII access and de-pseudonymization events are recorded on a separate audit channel with its own retention.
How this connects to regulation
Where this connects
What an auditor asks first.
See TENSOR running on your own estate.
30 minutes, screen-shared, no slides. Bring the process you are least sure we handle and we will start there.