Audit and evidence
Read tenant hash-chain events, download verified exports, monitor dead letters, and deliver signed SIEM events.
Every security-relevant transition appends a tenant-scoped audit event chained to the previous event hash.
Console audit
Use Audit to filter events by action, actor, resource type, resource ID, or hash. The view also reports:
- exporter initialization;
- the latest immutable root status;
- export cursor and lag;
- dead-letter count; and
- available customer export downloads.
Immutable export
The audit exporter validates each tenant chain, writes versioned NDJSON to S3 Object Lock, and signs daily roots with KMS. An integrity failure is fail-closed; it is not converted into a normal delivery retry.
Customer download
Authorized users can request a bounded export and download the completed artifact. Verify the included hash-chain and root evidence before importing it into long-term storage.
Dead letters
Delivery failures are isolated per tenant and destination. Owners and admins may replay an eligible dead letter with recent MFA, a reason, and an evidence reference. Replaying does not mutate the original event.
SIEM webhooks
Signed CloudEvents webhooks are independent of the immutable S3 export. A receiver outage cannot block the primary audit chain or daily root.