Audit Trail

ATStatus includes an enterprise-grade audit logging system with hash chain verification, ensuring complete traceability and tamper evidence for all administrative actions.

How the Audit Trail Works

┌─────────────────────────────────────────────────────────────┐
│                     Audit Event Chain                        │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  Event #1          Event #2          Event #3               │
│  ┌──────────┐     ┌──────────┐     ┌──────────┐            │
│  │ Action   │     │ Action   │     │ Action   │            │
│  │ Actor    │     │ Actor    │     │ Actor    │            │
│  │ Time     │     │ Time     │     │ Time     │            │
│  │ Hash: A  │────▶│ Hash: B  │────▶│ Hash: C  │────▶ ...  │
│  │ Prev: ∅  │     │ Prev: A  │     │ Prev: B  │            │
│  └──────────┘     └──────────┘     └──────────┘            │
│                                                              │
│  If Event #1 is modified, Hash A changes,                   │
│  which invalidates Hash B, Hash C, and all subsequent.      │
└─────────────────────────────────────────────────────────────┘

What Gets Logged

The audit system captures all significant administrative actions:

Audit Event Structure

Each audit event contains the following information:

Severity Levels

Accessing Audit Logs

Admin Panel

Access audit logs at /admin/audit. The interface provides:

• Filtering: By date range, severity, event type, user, entity
• Search: Full-text search across event data
• Detail View: Expand events to see full change details
• Export: Download logs in JSON or CSV format

Sensitive Data Access

Tamper Detection

The hash chain provides automatic tamper detection. If anyone attempts to modify a historical audit entry:

1. The modified entry's hash would change
2. The next entry's prevHash would no longer match
3. All subsequent entries become invalid
4. The chain break is detectable by validating hashes

// Hash verification pseudocode
function verifyChain(events) {
  for (let i = 1; i < events.length; i++) {
    const expectedPrevHash = computeHash(events[i-1]);
    if (events[i].prevHash !== expectedPrevHash) {
      return { valid: false, brokenAt: i };
    }
  }
  return { valid: true };
}

Compliance Benefits

Log Retention

By default, audit logs are retained indefinitely. For compliance with data retention policies, you can implement log archival or deletion procedures:

• Export logs before deletion for archival
• Consider regulatory requirements (some require 7+ years retention)
• Database cleanup can be done via Prisma or direct SQL