The audit trail is the product
Enterprise buyers are not asking whether the thing works. They are asking what happens in the room where someone has to explain what it did.
Inès Lefebvre
Head of Security
There is a question that comes up in the third or fourth call with every regulated buyer, and it is never phrased as a technical requirement. It sounds like: 'if this goes wrong, what do I show them?'
Them is a regulator, an auditor, a board, or a customer's legal team. The honest answer for most platforms is a screenshot of a log viewer, and that answer loses the deal in the room, silently, before anyone says no.
What an auditable record actually requires
An audit trail is not a log with better formatting. It has properties a log does not, and each of them is a design decision that has to be made before the first line is written, not after the first audit.
- Append-only, with tamper-evidence. If a record can be edited, its value in a dispute is zero, and being able to say so credibly is the whole point.
- Complete. A trail with gaps is worse than none, because the gaps are where the questions go.
- Attributable. Every action ties to an identity — a person, a service or an automated client — and to the policy that permitted it.
- Legible to a non-engineer. If explaining an entry requires an engineer, the trail does not work in the room it exists for.
- Exportable. It has to leave the system in a form somebody else's tooling can read.
Legibility is the one people skip
The audience for an audit trail is a person under time pressure who does not work in your product and does not want to. Design for them and the engineering audience is covered for free. Design for engineers and the other audience is not covered at all.
In practice this means every entry answers who, what, when, under what authority, and with what effect — in a sentence, before any of the structured detail. The detail should be one click away and never in the way.
Retention is a product decision
How long the trail is kept is not an infrastructure setting. It is determined by the longest limitation period any customer is subject to, and it varies by industry and jurisdiction. Getting this wrong in either direction is expensive: too short and the record is gone when it is needed, too long and it becomes a liability of its own under data-minimisation rules.
We settled on configurable retention per workspace with a hard floor, an explicit legal-hold flag that suspends deletion, and a deletion record that survives the deletion. The last one surprises people. If a record is removed on schedule, the fact that it existed and was removed on schedule is itself part of the trail.