Audit log
append-only · each entry hashes the previous one · retention 7y financial / 3y everything else
| When (AEST) | Actor | Action | Target | Before → after | Context |
|---|---|---|---|---|---|
| 11 Sep 8:02pm | Priya Shah | export · PII purpose note | sales-sep-mtd.csv (no PII cols) | purpose: "Sep MTD board pack" | iPad · SMS MFA |
| 11 Sep 6:40pm | Maya Chen | coupon · edit v3 | SPRING25 | hero alt "" → missing flagged | workstation · passkey |
| 11 Sep 5:20pm | ops-lead (K. Ford) | flag · kill-switch ON | locker-email-fallback | 0% → 100% (INC-44) | 2 humans: K. Ford + Dan |
| 11 Sep 2:15pm | system (auto) | order · safe-drop auth stored | APX-2026-08412 | instruction text hashed, not logged plain | checkout service |
| 11 Sep 9:02am | invite n.chen@ (unactivated) | login · invite not activated | — | blocked: invite unused | alert suppressed (expected) |
| 10 Sep 4:12pm | Priya Shah | coupon · approve v3 | SPRING25 schedule | draft → scheduled 26 Sep | iPad · SMS MFA |
| 10 Sep 11:31am | counsel (H. Marsh) | cms · lock legal pages | /terms v19, /privacy v21 | editable → counsel-only | hardware key |
| 9 Sep 9:14pm | J. Okafor (suspended) | login · blocked | token replay, new device | denied · token family rotated | page → Dan + counsel |
| 8 Sep 7:00am | system (job) | report · scheduled run | product-performance wk36 | 2m 04s · delivered retail@ | batch identity |
| 2 Sep 3:40pm | Dan Whitlam | key · rotate | Stripe webhook signing secret | wh_…8B0 → wh_…8B1 | hardware key + 2nd approver |
What always lands in the log
Every PII unmask + the reason string typed for it
Every money move: refunds, credits, price-rule publishes, both 4-eyes signatures
Key creation/rotation/revocation and flag kill-switch pulls
Every login outcome — including the boring successes for super-admin roles
Integrity & access
- Chain
- SHA-256 linked · verified hourly + on read
- Storage
- WORM bucket, AU region, 7y financial tail
- Who can read
- super-admin + counsel (own-actions everywhere)
- Export
- counsel pack = signed PDF + CSV, watermarked
- Edit / delete
- impossible by design — corrections are new entries
Customer-facing mirror: Charlotte's Privacy & data page shows her own access log (who unmasked what, when) — trust works both ways (APP 12).