Audit Trail
Overview of Disclosurely audit history, case activity tracking, and review-oriented record keeping.
If your team is comparing vendor workflows, review whistleblowing case management software for how audit history fits into intake, investigation, closure, and procurement evaluation.
Disclosurely maintains audit history to support operational accountability, internal review, and customer governance processes.
Further Reading
- EU-Compliant Whistleblowing Software With Audit Trail provides a buyer checklist for evaluating audit evidence, exports, permissions, and reviewability.
Overview
Public wording for the audit trail should remain careful:
- Audit history supports traceability across report handling and case activity
- Records are intended to help teams understand who did what and when
- Exportable history can support internal review, customer review, and legal or governance processes
- Public materials should avoid absolute claims such as "every action," "immutable," or "cannot be altered" unless those are being formally warranted
Consolidated Scope
This page is the canonical authority page for Disclosurely audit history. It covers the useful procurement and implementation material previously split across compliance and feature documentation:
- case activity history
- user action tracking
- operational event logging
- export support for review processes
- structured record data for integrity review
Use this page for buyer, legal, compliance, and security review. Feature-level audit trail material should point here rather than creating a second indexable page with the same intent.
Typical Records
Audit history may include:
- Case submission, assignment, and status changes
- Note, evidence, and message activity
- User access and workflow events
- Administrative configuration changes relevant to customer operations
- Related timestamps and record metadata used for internal review
How To Describe Integrity
Where audit-record integrity fields exist, the safe public description is:
- Audit records are designed to support change detection and record integrity review
- Audit history is structured for traceability rather than marketed as an absolute guarantee
- Customers evaluating formal evidentiary or regulatory requirements should request current supporting documentation
Compliance Context
Audit history can help teams operating under:
- EU Whistleblowing Directive workflows
- GDPR-aware access and retention review
- SOX-related reporting programmes
- Internal investigation and governance processes
That support should not be described as automatic legal compliance or certification.
Related Resources
What Gets Logged
User Actions
Account Activities:
- Login attempts (successful and failed)
- Logout events
- Password changes
- Email address updates
- Account creation
- Account deactivation
- Permission changes
Case Activities:
- Case viewed
- Case assigned/reassigned
- Status changed
- Notes added or edited
- Evidence uploaded
- Evidence downloaded
- Evidence deleted
- Messages sent
- Tags added/removed
- Priority changed
Administrative Actions:
- Team member invited
- User role changed
- Organization settings modified
- Branding updated
- Domain configured
- Subscription changed
- Integrations configured
- Retention policies set
- Legal holds applied/released
System Events
Automatic Activities:
- Report submitted
- Auto-assignment triggered
- Notification sent
- Scheduled tasks run
- Data archiving
- Data deletion
- Backup completion
- System health checks
Security Events:
- Failed authentication attempts
- Account lockouts
- Suspicious activity detected
- IP address changes
- Session timeouts
- API access
- Integration connections
- Certificate renewals
Audit Log Structure
Log Entry Fields
Each audit entry contains:
Timestamp:
- Exact date and time (UTC)
- Millisecond precision
- Timezone indicator
Actor:
- User who performed action
- User ID (immutable)
- User role at time
- IP address
- Geographic location (approximate)
- Device/browser fingerprint
Action:
- What was done
- Standardized action codes
- Human-readable description
- Severity level
Object:
- What was acted upon
- Case ID, user ID, setting name, etc.
- Before state (if modified)
- After state (if modified)
Context:
- How action was performed (UI, API, automation)
- Related objects
- Parent actions
- Session identifier
Integrity:
- Hash of this entry
- Hash of previous entry
- Chain position
- Signature
Hash Chain Integrity
How It Works:
-
First Entry
- Initial hash calculated from entry data
- Becomes baseline for chain
-
Subsequent Entries
- Entry data + previous entry's hash = new hash
- Creates cryptographic link
- Any tampering breaks chain
-
Verification
- Recalculate all hashes
- Compare to stored hashes
- Any mismatch = tampering detected
- Shows exactly where tampering occurred
Benefits:
- Traceability: Helps teams review who did what and when
- Change review: Supports investigation of unusual or disputed activity
- Integrity review: Chained record data can support internal verification processes
- Governance support: Useful for internal and customer review
Viewing Audit Logs
Accessing Logs
Permission Required:
- Organization Administrator
- Compliance Officer (if role exists)
- Auditor (read-only)
Navigation:
- Dashboard > Compliance > Audit Trail
- Select date range
- Apply filters
- View log entries
Filtering Logs
By Time:
- Last 24 hours
- Last 7 days
- Last 30 days
- Custom date range
- Specific time period
By User:
- Specific user
- All users
- Role type
- External users (API)
- System actions
By Action Type:
- Case actions
- User management
- Settings changes
- Security events
- System events
- All actions
By Object:
- Specific case
- Specific user
- Settings category
- All objects
By Severity:
- Critical (security events, deletions)
- High (major changes)
- Medium (standard actions)
- Low (view actions)
- Info (system events)
Search Functionality
Keyword Search:
- Search all log entries
- Action descriptions
- User names
- Object IDs
- Context information
Advanced Search:
- Combine multiple filters
- Date range + user + action
- Boolean operators
- Regular expressions
- Save search queries
Compliance Uses
Regulatory Compliance
- Demonstrates report handling timeline
- Shows acknowledgment within 7 days
- Proves feedback within 3 months
- Documents confidentiality measures
- Audit history can support implementation review
GDPR:
- Track data access
- Document data exports
- Verify deletions occurred
- Demonstrate consent handling
- Support data subject requests
- Audit trail of financial report investigations
- Document controls and processes
- Demonstrate segregation of duties
- Prove data retention compliance
ISO 27001-style review:
- Information security event logging can be relevant when customers map their own controls
- Access control review may use audit history as supporting evidence
- Incident response documentation can reference audit activity where appropriate
- This page does not claim ISO 27001 certification
Internal Audits
Quarterly Reviews:
- Case handling efficiency
- User activity patterns
- Compliance with procedures
- Security event analysis
- Process improvements
Annual Audits:
- Comprehensive log review
- Retention compliance verification
- Security assessment
- User access review
- Hash chain integrity check
External Audits:
- Provide filtered audit logs
- Export for auditor review
- Support customer review processes
- Verify integrity
- Support findings
Audit Reports
Pre-Built Reports
User Activity Report:
- Actions by user over period
- Login patterns
- Case access history
- Administrative changes
- Anomaly detection
Case Activity Report:
- All actions on specific case
- Timeline view
- User involvement
- Evidence handling
- Status changes
Security Event Report:
- Failed login attempts
- Account lockouts
- Suspicious activities
- Permission changes
- Integration access
Compliance Report:
- Report handling timeline
- Acknowledgment timeliness
- Feedback timeliness
- Data retention compliance
- Policy adherence
Change Management Report:
- Settings changes
- User role modifications
- Policy updates
- Configuration changes
- Administrative actions
Custom Reports
Build Your Own:
- Select fields to include
- Choose filters
- Set date range
- Select output format
- Save or export
Output Formats:
- PDF (formatted report)
- CSV (spreadsheet analysis)
- JSON (programmatic access)
- Excel (data analysis)
Scheduling:
- One-time report
- Daily digest
- Weekly summary
- Monthly compliance report
- Custom schedule
Export and Integration
Exporting Audit Logs
Export Options:
- Filtered subset
- Complete logs
- Date range
- Specific cases
- User activities
Formats:
- CSV (spreadsheet)
- JSON (structured data)
- XML (enterprise systems)
- CEF (SIEM integration)
- Syslog format
Integrity Verification:
- Export formatting may include integrity-related fields where available
- Customers should request current export and verification details during evaluation
- Reviewers can validate exported records against current product behaviour
- Public materials should avoid framing this as an absolute authenticity guarantee
SIEM Integration
Security Information and Event Management:
Supported Platforms:
- Splunk
- IBM QRadar
- LogRhythm
- ArcSight
- Elasticsearch/ELK Stack
- Microsoft Sentinel
Integration Method:
- Real-time log streaming
- Webhook delivery
- API polling
- Syslog forwarding
- File-based transfer
Use Cases:
- Centralized security monitoring
- Correlation with other systems
- Advanced threat detection
- Compliance reporting
- Incident response
Retention and Storage
Audit Log Retention
Retention Period:
- Retention depends on product configuration and customer policy
- Customers should verify current retention settings and legal obligations for their programme
- Longer retention may be appropriate for some regulated use cases
Storage:
- Encrypted at rest
- Geographically redundant
- Separate from case data
- Highly available
- Backed up independently
Audit Log Size
Typical Size:
- 100 cases/month ≈ 1GB logs/year
- 1,000 cases/month ≈ 10GB logs/year
- Scales with activity level
Storage Costs:
- Included in subscription
- No additional charge
- Unlimited retention
- All plans
Integrity Verification
Verifying Hash Chain
Automated Verification:
- Internal integrity checks may be run as part of operational monitoring
- Customers should request current details if they need a formal control description
Manual Verification:
-
Export Audit Logs
- With hash chain data
- Select period to verify
- Download verification tool
-
Run Verification
- Command-line tool
- Or web-based verifier
- Recalculates hashes
- Compares to originals
-
Review Results
- "Integrity verified" if clean
- "Tampering detected" if compromised
- Shows exact point of break
- Generate verification report
Use Cases:
- Audit preparation
- Legal proceedings
- Incident investigation
- Compliance demonstration
- Third-party verification
Third-Party Verification
Independent Auditors:
- Provide scoped exports where appropriate
- Reviewers can assess record structure and timestamps
- Additional documentation may be required for formal assurance exercises
Advanced Features
Anomaly Detection
Operational Review:
- Unusual access patterns
- Off-hours activity
- Excessive downloads
- Rapid status changes
- Geographic anomalies where relevant data is available
Alerts Generated:
- Internal teams may review unusual events
- Investigations can use audit history as supporting context
- Customers should verify current alerting behaviour during evaluation
Examples:
- User accessing 100+ cases in 1 hour
- Login from unusual location
- Multiple failed login attempts
- Bulk evidence downloads
- After-hours administrative changes
Correlation Analysis
Cross-Reference Events:
- Related actions across time
- Multiple users on same case
- Pattern detection
- Workflow analysis
- Efficiency insights
Use Cases:
- Identify bottlenecks
- Optimize processes
- Detect collusion
- Verify segregation of duties
- Improve workflows
Best Practices
Regular Review
Who Should Review:
- Compliance Officer: Monthly
- Security Team: Weekly
- Administrators: Daily (high-level)
- Auditors: Quarterly
What to Look For:
- Unusual activity patterns
- Failed access attempts
- Unexpected administrative changes
- After-hours activity
- Bulk data access
Document Review
Create Review Log:
- Date of review
- Who performed review
- Findings
- Actions taken
- Follow-up required
Demonstrate Diligence:
- Regular oversight
- Active monitoring
- Responsive to issues
- Compliance commitment
Set Up Alerts
Critical Events:
- Failed login after 3 attempts
- Account created or deleted
- Legal hold applied/released
- Data deletion
- Settings changes
- Permission elevations
Notification Method:
- Email to security team
- SMS for critical events
- Slack/Teams integration
- SIEM alert
- In-app notification
Segregate Duties
Who Can See What:
- Investigators: Case audit logs only
- Administrators: User management logs
- Compliance: All logs (read-only)
- External Auditors: Filtered exports
Prevent Conflicts:
- Can't audit own actions comprehensively
- Independent review
- Checks and balances
- Accountability
Compliance Scenarios
Data Subject Request (GDPR)
Request: User wants to know all their data access
Response:
- Filter audit log by subject's case
- Export all view/access events
- Show who accessed when
- Reference applicable access and handling controls
- Provide report to data subject
Regulatory Investigation
Request: Regulator asks about specific case handling
Response:
- Export relevant audit history for the case
- Show timeline from submission to resolution
- Demonstrate timely acknowledgment
- Prove feedback provided
- Verify integrity with hash chain
- Provide verification certificate
Internal Investigation
Scenario: Suspected leak of confidential case information
Investigation:
- Filter audit log for case
- View all access events
- Identify who viewed/downloaded evidence
- Check for unusual patterns
- Cross-reference with leak timing
- Document findings
- Take appropriate action
Litigation Discovery
Scenario: Employment tribunal requests investigation records
Response:
- Apply legal hold to prevent deletion
- Export relevant audit logs
- Demonstrate process followed
- Show procedural fairness
- Verify integrity
- Provide to legal counsel
- Maintain chain of custody
Troubleshooting
Cannot Access Audit Trail
Check:
- Do you have required permissions?
- Organization Administrator or Compliance Officer role needed
- Contact admin to request access
Audit Log Missing Entries
Verify:
- Correct date range selected
- Filters not hiding entries
- Time zone settings
- System outage during period (rare)
- Contact support if confirmed gap
Hash Chain Verification Failed
Immediate Actions:
- Do not delete or modify logs
- Document verification failure
- Notify security team
- Contact Disclosurely support
- Preserve evidence
- Investigate potential compromise
Possible Causes:
- Software bug (most likely)
- Database corruption
- Attempted tampering (rare)
- Export/import error
Export Failed
Solutions:
- Reduce date range (less data)
- Try different format
- Check internet connection
- Contact support if persists
Related: