Audit Logs You Can Trust

Short summary

Explains how to build trustworthy audit logs for SaaS, distinguishing them from application logs by prioritizing completeness, immutability, and actor identity. Provides a PostgreSQL schema with before/after state tracking, stable action naming conventions, and organization-scoped indexing. Recommends starting with actions customers or auditors actually ask about rather than auditing every table upfront.

• •Audit logs must be complete, immutable, and attributable to a real actor
• •Schema includes before_state/after_state JSONB for rendering diffs without re-derivation
• •organization_id on every row is non-negotiable for multi-tenant systems

Generated with AI, which can make mistakes.