Auditing at a Glance
Two logs
| Log | Records |
|---|---|
| Audit | Data changes — creates, updates, deletes, merges |
| Security audit | Sign-ins, permission grants, policy and masking changes, rejected outbound destinations |
Separating them means a security review is not searching through routine record edits.
What immutability guarantees
| Guarantee | Exception |
|---|---|
| No updates | None |
| No deletes | The retention purge |
| Gap detection | A purge produces gaps legitimately |
Ordinary writes cannot modify or delete an entry — a database trigger refuses them, for every caller including administrators.
A permissioned retention endpoint disables that trigger and deletes entries older than the retention window, from both logs. Immutability is a property of normal operation, not an absolute.
Treat that permission as among the most sensitive the platform issues: it is the only capability that can remove evidence.
A gap is not proof of tampering
A sanctioned purge produces exactly the same signal. Read a gap as "entries are missing here", then establish whether a purge covers that window.
Masking
| Element | Masked |
|---|---|
| Old and new values | Yes, where a rule applies |
| Actor identity | Never |
Hiding who made a change would defeat the audit trail. Withhold the audit permission instead.
Audit versus history
| Answers | |
|---|---|
| Audit log | Who did what, and when |
| Temporal history | What a record looked like at a time |
Most investigations need both: history establishes the value was wrong, the audit log establishes who made it so.
Retention
There is no retention setting and no scheduler. Entries are kept indefinitely until an operator explicitly calls the purge, which takes the window as a parameter each time it runs.
So the risk runs both ways: audit data accumulates forever unless you schedule the purge yourself, and a data-minimisation obligation you believe is being met automatically is not being met at all.
Export anything you must keep before you purge. A purge cannot be undone from within the platform.