The gap between reporting and evidence
Most platforms answer compliance questions with a dashboard: counts, trends, a filterable activity feed. It demonstrates that the system observes itself, which is worth something, and it is not what a review asks for.
A reviewer asks a narrow question. This account was contacted on the 14th — who selected it, under which rule, and who approved the escalation? The useful answer is one record with four fields. A dashboard that can show ten thousand events but cannot reconstruct that specific chain does not help.
Why a log needs to be tamper-evident
The second question is harder: how do we know this record was written when it says, rather than assembled after the complaint arrived? An append-only claim in your documentation is not evidence, because the reviewer has no way to test it.
We hash-chain audit entries, so each includes a digest of its predecessor. Altering or removing an entry breaks the chain at that point, and verification reports the first broken link rather than a bare pass or fail. This does not make tampering impossible; it makes it detectable, which is the achievable property and the one that carries weight in a review.
What this means when you are preparing
Rehearse one request end to end before you need to. Pick a real account, ask the four questions, and time how long the answer takes. Most teams discover the trail exists in three systems that do not share an identifier, which is a problem worth finding on a quiet afternoon.
And be careful about what any vendor, including us, claims here. A platform can record what happened inside it and help you evidence your own obligations. It cannot make your organisation compliant, and any tool that implies otherwise is selling you a document rather than a control.
More from the blog
- Engineering
Idempotency is a security control, not a reliability nicety
We shipped a retry that could refund the same order twice. The fix was one line; understanding why it was a security bug rather than a reliability bug changed how we review every payout path.
Read - AI safety
Redact before the model call, not after
Filtering a model's response is not privacy engineering. If the prompt contained a customer's access token, the token has already left your tenancy.
Read - Product
Approval gates that people actually use
A queue that flags everything gets approved without being read. Our first approval design was technically correct and completely useless, and fixing it meant admitting the volume was the bug.
Read