Tamper-evident audit log with immutable off-site storage

The audit log is now tamper-evident. Every entry is sealed into a hash chain within seconds, the gateway refuses to change or delete entries, and a change made directly in the database is detected. The Audit Log page shows whether the chain is intact and when it was last checked, re-verifies on demand, and runs a check daily. Every minute the chain is pinned by a signed checkpoint, so a rewritten history is provable.

The log can also be copied into an S3-compatible store with Object Lock, where no one — including administrators or root on the host — can delete or shorten it before its retention ends (10 years by default, extendable but never shortened). The gateway now runs under a restricted database account that cannot alter or disable the audit trail.

No action required.