Documentation

Last reviewed: May 2026

Audit Logging & Integrity

This page explains how Widgi AI keeps its audit logs trustworthy: that they cannot be altered, that any tampering would be detectable, and that they support a proper forensic investigation. It is the public summary of our internal logging-integrity control.

In short

Audit logs can only be added to — never changed or deleted. They are copied nightly into an immutable archive protected by AWS Object Lock in COMPLIANCE mode, which prevents any change for three years — including by the AWS account root. Each day's archive is also cryptographically hash-chained to the day before, so any tampering is detectable; security-relevant events raise real-time alerts.

1. Protected from modification by administrators

  • Append-only — every audit record is written so it can only be created, never overwritten.
  • No deletion path — there is no feature, screen or API anywhere that lets anyone (including administrators) edit or delete an audit record. Records only leave by automatic expiry at the end of their 3-year retention.
  • Admin actions are themselves logged — sensitive actions such as granting access are recorded with who did it, the outcome, and a written justification.

2. Immutable and tamper-evident

Immutable: audit records are copied nightly into a dedicated archive protected by AWS Object Lock in COMPLIANCE mode for three years. In this mode the records cannot be deleted or modified by anyone — including the AWS account root — until the retention period ends.

Tamper-evident: on top of that, each day's archive is hash-chained. We record a unique fingerprint (SHA-256) of every archived file and link each day to the previous day's fingerprint:

The hash chain

Day 1 files ──sha256──▶ H1
Day 2 files + prevHash:H1 ──sha256──▶ H2
Day 3 files + prevHash:H2 ──sha256──▶ H3 ...
If any archived record were altered, its fingerprint would change and the chain would no longer verify. Tampering is therefore not only prevented (Object Lock) but provably detectable (the hash chain).

3. Support for forensic investigation

  • Complete, unalterable history — a 3-year append-only live record plus a 3-year immutable, hash-chained archive.
  • Rich detail — each record captures who, what, when, the outcome, source IP and device, for a full who-did-what-when-where trail.
  • Real-time alerts — security-relevant events (e.g. admin activity without MFA, expired-access attempts, permission-grant or export bursts, failed-login spikes) raise alarms immediately.
  • Independently verifiable — because integrity rests on Object Lock plus a published hash-chain method, an external investigator can confirm the archive is untampered without having to trust us — they simply recompute the hashes.

The bottom line

Audit logs are append-only with no modification or deletion path; made immutable by COMPLIANCE-mode Object Lock and tamper-evident by a SHA-256 daily hash chain; and backed by real-time alerting and independently verifiable integrity — a complete, provable history for investigation.