An audit log auditors trust.
Append-only, hash-chained, verified daily. Every action across every module is recorded in a tamper-evident log that you can export and an auditor can independently verify.
Capabilities
Append-only, enforced by the database
Entries are written once, never modified or deleted. The application's database role has UPDATE and DELETE revoked on the audit table — append-only is enforced by Postgres, not left to convention.
Hash-chained
Each entry stores a SHA-256 hash of the previous entry together with the row's own canonical contents, chained per tenant. Tampering with any record breaks the chain — detectable by anyone with the export.
Daily verification
An automated verifier checks chain integrity daily and exports chain heads. Gaps or breaks trigger alerts.
Cold export to immutable storage
Every day, the chain heads are exported to object-locked EU storage — write-once, outside the running database — so the evidence survives even if the live system is compromised.
Cross-module coverage
Incidents, changes, CMDB edits, permission changes, de-pseudonymization requests, login events — everything is logged.
Retention that meets the rule
Seven years by default, extended to ten when the MaRisk toggle is on. PII access and de-pseudonymization events are recorded on a separate audit channel with its own retention.
How this connects to regulation
Related features
FAQ
See TENSOR against your own compliance checklist.
30 minutes. We’ll map it to your DORA / NIS-2 / BAIT obligations.