Tamper-evident audit log that passes a SOC 2 review.

Generated migrations install a Postgres trigger that raises on UPDATE or DELETE of audit_events. Tampering is impossible at the application layer because the database itself rejects mutation.

Every event is hashed with the previous event’s hash. The reader verifies the chain on load and surfaces tamper_detected: true if any link breaks. Per-workspace sequence numbers keep tenants isolated.

Fields flagged pii: true in the event payload are redacted to ***REDACTED*** for non-admin readers. Admins see the full payload, and the read itself is audited.

POST /api/audit/replay reconstructs entity state at any past timestamp by replaying the event stream. Forensic investigation without restoring backups.

Periodic batch export to Splunk HEC, Datadog Logs, or CloudWatch Logs. Idempotent via per-(workspace, sink) cursor — restart safely after any failure with no duplicates and no loss.

workspace_id is on every event row and every read query is scoped to it. The architecture forbids cross-tenant audit reads even for admins.