Audit log

Everything that matters is recorded: sign-ins and failed sign-ins, every autonomous decision and the gates behind it, merges, reverts, regressions, policy changes and their reasons, emergency stops, status changes, accepted risks, connections made or removed, AI requests, and assistant calls. Every role can read it under Audit log.

Tamper-evident

Each entry holds a cryptographic hash of the one before it, so changing, removing or reordering any entry breaks the chain from that point. The database refuses edits and deletions, apart from the two deliberate exceptions below: removing entries past the retention period, and anonymizing the log when an organisation leaves. The badge at the top (Chain verified, with the number of entries) is the result of recomputing the whole chain.

Entries name people by an internal ID, resolved to their current email when you read the log, so removing a person never means editing the log.

Filtering

Filter by Sign-in & access, Autonomy & fixes, Findings or Integrations. Routine entries such as hourly syncs are hidden unless you tick Show routine syncs; they're never deleted.

Export and verify it yourself

Export downloads the chain as NDJSON, one entry per line, oldest first, exactly as hashed. You can verify it outside Akesis with verifyChain() from Akesis's core library. If old entries have been removed under the retention period, the file's first line is {"anchor": {"seq": …, "prevHash": "…"}}, which says where the chain now starts; pass it to verifyChain(records, anchor).

How long it's kept

Admins choose how long entries are kept, from 1 to 10 years (7 by default), at the top of the Audit log page. Shortening it asks for a reason, because older entries are removed at the next daily run. Every change is audited. After removal the chain still verifies from the first entry kept.

When an organisation leaves Akesis, its log is anonymized rather than deleted; see Administration.