What is logged
Every significant event in Enclave produces an audit log entry:Log integrity
Enclave’s audit trail is append-only and tamper-evident. Integrity is enforced at three independent layers, so tampering is detectable regardless of who attempts it — including an operator with direct database access.1. Hash chain (every entry)
Each entry stores a SHA-256 hash computed over its own contents and the hash of the preceding entry, forming a continuous chain per organisation and service. The hash covers every persisted field:- Event type and action
- Actor (type, role, user ID, email)
- Target resource (type and ID)
- Outcome (success, denied, failed) and reason
- Event metadata, source IP, and user agent
- Timestamp and request ID
- Previous entry hash (the chain link)
2. Off-box anchoring
On a scheduled basis Enclave records an anchor — a self-chained checkpoint of each chain’s head hash and entry count — and forwards it to your SIEM. Because the anchor lives in an external, independent system, history cannot be rewritten in the database without contradicting a record that is out of the operator’s reach.3. KMS-signed exports
Every export is signed with HMAC-SHA256 using a single-use key wrapped by your organisation’s KMS key (AWS KMS or Thales CipherTrust). Verifying an export requires a live call to your KMS, so a copied file — even alongside a full database dump — cannot be forged or altered undetected.Verifying the audit log
To confirm an exported file is authentic and unmodified, re-upload it to Enclave from the Audit Log screen. Enclave recomputes the HMAC through your KMS and reports whether every row matches the signature — a single changed, added, or removed row fails verification. Owners can additionally run a full chain verification across the live audit store. This walks the hash chain (and its anchor chain) from end to end and reports the exact location of any break — the detective control auditors expect under SOC 2 CC7.2 and NIST AU-6. A chain break also raises a security alert and is forwarded to your SIEM automatically.Compliance & standards
Enclave’s audit logging is built to satisfy the audit-trail controls required by the major security and privacy frameworks. The table maps each control to how Enclave implements it.
Guidelines followed
- Interchange formats — SIEM output is emitted as CEF v0 (ArcSight Common Event Format) and syslog (RFC 5424, RFC 5425 over TLS), plus structured JSON — the formats enterprise SIEMs ingest natively.
- Cryptography — SHA-256 chaining, HMAC-SHA256 export signatures, and KMS/HSM-held keys, in line with NIST FIPS 180-4 and FIPS 198-1.
- Least privilege — export requires the
audit_viewcapability; full chain verification is restricted to Owners.
These controls describe how Enclave’s audit subsystem is engineered. For Kvelden’s organisational certification and attestation status, see Compliance.
Exporting logs
Exports are available at Settings → Audit Log → Export:- Format — CSV, with a cryptographic signature block appended as a trailer
- Date range — filter by start and end date
- Event types — filter by action category
- User — filter by specific actor
Real-time delivery
Audit events can be delivered in real time to external systems via two mechanisms:- Webhooks — HTTP POST to any HTTPS endpoint, HMAC-signed, with automatic retries. Managed at Organisation → Webhooks. Learn more →
- SIEM Forwarder — syslog (RFC 5424) or CEF over UDP/TCP for on-premise deployments that cannot accept inbound HTTPS. Configured at Organisation → SIEM Settings.
Security alerts
Audit events also feed into Enclave’s alerting engine:- Policy alerts fire when specific audit actions occur (room deleted, role changed, KMS unassigned)
- Behavioral anomaly detection fires when a user’s file-access pattern crosses a threshold (bulk downloads, new country, off-hours access)
Retention
Retention periods can be extended on request for regulatory requirements. Logs cannot be shortened below 7 years for SOC 2 Type II compliance.