AWRA Help Center

Audit Logs sit under Security. Every audited action writes a row holding the time it occurred, the person (or system actor) behind it, the action and module, a description, and the request details — route, method, URL. Access to the audit trail needs the settings management permission.

Why It Is More Than A Log Table

Each row is signed over its own content and over the row before it, forming a chain per organization. That changes what the trail can prove:

• Edit a row and its signature stops matching.
• Delete a row and the next row's link to it stops matching.
• Insert a row and the sequence numbering collides or skips.

Re-signing the trail to hide any of this requires a key that is not stored in the database, so someone who reaches the database cannot quietly rewrite history in it.

To be precise about the claim: this makes tampering detectable, not impossible. Anyone with write access to a database can still delete rows. The point is that the deletion cannot be made to look like it never happened.

Verifying The Chain

The Verify action walks your organization's chain and reports what it found: how many rows were checked, any signature or sequence breaks, rows that were redacted, and rows carrying no chain position at all. Removals that happened through a legitimate retention purge are recognised as accounted for rather than reported as tampering. Running a verification is itself recorded in the trail.

A verification that reports unchained rows is telling you that part of the trail predates chaining or was written outside it — not that it was altered. Read the report rather than the headline.

Exporting

Exports carry the event columns first and the integrity columns — chain position and signature data — last, so someone reading the file sees the event before its metadata. Your organization's chain verifies on its own, which is what lets you hand an export to an auditor without it depending on anything outside your workspace.

Bundling It For An Auditor

When someone asks for evidence rather than a screen, build an Evidence Pack — audit logs plus approvals, access history, document activity and signature coverage, in one checksummed archive.