<media type="image" src="…"/>
as a child of <hero>, switching this page to the
full-bleed dark variant.
Recommended : 1920 × 1080 px (16:9)
Formats : PNG · JPEG · WebP · SVG
Off-spec uploads are rejected — aspect ratio outside 16:9 ±2 %, dimensions outside 800 × 450 … 3840 × 2160.
Every write — operational, financial, configuration — recorded with full context.
A journal that captures who did what, when, against which record, with the before-and-after values and the approval chain. Reversals create new entries; originals are never destroyed. The forensic question is a query, not a reconstruction.
Every write journalled
Operational, financial and configuration writes all produce audit entries — by construction, in the same transaction as the change.
Before and after
The previous value and the new value preserved. Reconstruction of any record at any past timestamp is a query against the journal.
User and approval context
Every entry carries the user identity, the role active at the time, the IP address where relevant, and the approval chain that authorised the change.
Immutable
Audit entries cannot be edited or deleted. Reversals create new entries that reference the original; the audit trail of the trail is preserved.
What the audit trail covers
Coverage scope
Master-data changes, transactional writes, configuration changes, role changes, batch-job executions — all journalled with the same discipline.
Entry structure
Timestamp, user, role-at-time, source IP, transaction context, before value (or null on create), after value (or null on delete), approval reference where applicable.
Tamper resistance
Audit entries are insert-only. Database-level controls prevent edits and deletes. Period-end snapshots cryptographically signed where the regime requires.
Reconstruction queries
Any record at any past timestamp reconstructable from the journal. The auditor opens the past by clicking a row and asking *show me 14 March 2025 at 09:15*.
Retention
Audit-trail retention per regime — Spanish 4-year minimum, longer for sector-specific regimes. Old entries archived to compliant storage with retrievability preserved.
Audit-mode queries
Pre-built reports for the questions auditors ask repeatedly: who approved that payment, who changed that bank-account record, who exported that customer list.
Why journalled-by-construction beats logged-after-the-fact
A logging-as-afterthought design (the application writes, then logs the write separately) has two failure modes: the log can be silenced (a code path that forgets to log), and the log can drift from the write (the write succeeds but the log fails). Either way the audit trail becomes a probabilistic record, not an evidentiary one.
Axional journals in the same transaction as the write. The audit entry and the data change either both succeed or both fail — there is no path where the data changes without an audit entry. The trail is evidentiary by construction.