Glossary
Audit Log
An audit log is an immutable, time-ordered record of significant events in a system, capturing who performed an action, what the action was, which resource it affected and when it occurred.
General definition
An audit log (also called an audit trail) is a persistent, append-only sequence of event records that documents the activity of users, administrators and automated processes within a system. The core attributes of each event record are typically: who (user or service identity), what (the action taken), which (the resource or object affected) and when (a precise timestamp).
- Compliance evidence: regulatory frameworks including HIPAA, SOC 2, ISO 27001 and PCI DSS require audit logs as proof that access controls and data-handling policies are enforced
- Security investigation: logs let incident responders reconstruct the sequence of events before and during a breach
- Operational accountability: administrators can see who changed a configuration setting, deleted a record or exported data
- Integrity assurance: effective audit logs are write-once; later entries cannot modify or remove earlier ones
Audit logs are most valuable when they are stored separately from the system they monitor, so a compromise of the primary system cannot also compromise the log. Common destinations include write-protected object storage (such as AWS S3 with object lock), a dedicated logging service or an immutable database table. They differ from application logs, which record errors and performance data rather than security-relevant user actions.
In the Ethora ecosystem
Ethora’s self-hosted and dedicated deployments generate audit logs for administrative actions: user provisioning and deletion, role changes, configuration updates, message exports and API key management. These logs are designed to be exported to immutable storage so they remain intact and provable even if the primary application instance is modified.
For healthcare customers working toward HIPAA compliance, a complete audit trail of who accessed which messages and when is a core requirement. The audit log works alongside data residency controls and SAML SSO to give compliance teams the documentation they need to satisfy auditors. See the self-hosted chat server and self-hosted LLM pages for deployment options.
