> ## Documentation Index > Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt > Use this file to discover all available pages before exploring further. # Audit Logs > Every access event in Enclave is logged, timestamped, and cryptographically signed. ## What is logged Every significant event in Enclave produces an audit log entry: | Category | Events | | ------------------- | ------------------------------------------------------------------- | | **Authentication** | Login, logout, failed login, MFA events, SSO sign-in | | **File operations** | Upload, download/view, rename, delete, share, version created | | **Room management** | Create, archive, restore, delete, member added/removed/role changed | | **Key management** | KMS added/removed/assigned/unassigned, key rotation | | **User management** | Invite, role change, status change, clearance change | | **Access reviews** | Review started, decision (approved/revoked), review closed | | **DLP** | File quarantined, file blocked, scan failed | | **Secrets** | Secret created, viewed, deleted | | **Admin actions** | Org Unit changes, policy changes, platform infra changes | | **Security** | Anomaly alert fired, policy alert fired | ## Log integrity Enclave's audit trail is **append-only** and **tamper-evident**. Integrity is enforced at three independent layers, so tampering is detectable regardless of who attempts it — including an operator with direct database access. ### 1. Hash chain (every entry) Each entry stores a SHA-256 hash computed over its own contents **and** the hash of the preceding entry, forming a continuous chain per organisation and service. The hash covers **every persisted field**: * Event type and action * Actor (type, role, user ID, email) * Target resource (type and ID) * Outcome (success, denied, failed) and reason * Event metadata, source IP, and user agent * Timestamp and request ID * Previous entry hash (the chain link) Inserting, deleting, reordering, or editing any historical entry breaks the chain at the next link and is surfaced on verification. ### 2. Off-box anchoring On a scheduled basis Enclave records an **anchor** — a self-chained checkpoint of each chain's head hash and entry count — and forwards it to your SIEM. Because the anchor lives in an external, independent system, history cannot be rewritten in the database without contradicting a record that is out of the operator's reach. ### 3. KMS-signed exports Every export is signed with **HMAC-SHA256** using a single-use key wrapped by your organisation's KMS key (AWS KMS or Thales CipherTrust). Verifying an export requires a live call to your KMS, so a copied file — even alongside a full database dump — cannot be forged or altered undetected. ## Verifying the audit log To confirm an exported file is authentic and unmodified, re-upload it to Enclave from the **Audit Log** screen. Enclave recomputes the HMAC through your KMS and reports whether every row matches the signature — a single changed, added, or removed row fails verification. Owners can additionally run a **full chain verification** across the live audit store. This walks the hash chain (and its anchor chain) from end to end and reports the exact location of any break — the detective control auditors expect under SOC 2 CC7.2 and NIST AU-6. A chain break also raises a security alert and is forwarded to your SIEM automatically. ## Compliance & standards Enclave's audit logging is built to satisfy the audit-trail controls required by the major security and privacy frameworks. The table maps each control to how Enclave implements it. | Framework / control | Requirement | How Enclave meets it | | ----------------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------- | | **NIST SP 800-53 — AU-2 / AU-3** | Log the right events with sufficient content | Typed events capture actor, action, resource, outcome, UTC timestamp, source IP, and request ID | | **NIST SP 800-53 — AU-6** | Review and analyse audit records | Scheduled and on-demand chain verification, plus behavioural anomaly and policy alerts | | **NIST SP 800-53 — AU-9 / AU-9(2)** | Protect audit information from modification | SHA-256 hash chain over every field, with off-box SIEM anchoring | | **NIST SP 800-53 — AU-10** | Non-repudiation | KMS-signed exports (HMAC bound to your KMS key) | | **ISO/IEC 27001:2022 — A.8.15** | Logging | Centralised, structured, append-only event logging | | **ISO/IEC 27001:2022 — A.8.16** | Monitoring activities | SIEM forwarding with anomaly and policy alerting | | **SOC 2 — CC7.2 / CC7.3** | Detect and respond to anomalies | Tamper detection, real-time alerting, and evidence export | | **HIPAA — §164.312(b)** | Audit controls for ePHI access | Every file access and administrative action logged and retained | | **GDPR Art. 5(2) / DPDP Act 2023** | Accountability and demonstrable records | Immutable record of processing and access, exportable for audit and DSAR response | **Guidelines followed** * **Interchange formats** — SIEM output is emitted as **CEF v0** (ArcSight Common Event Format) and **syslog (RFC 5424, RFC 5425 over TLS)**, plus structured JSON — the formats enterprise SIEMs ingest natively. * **Cryptography** — SHA-256 chaining, HMAC-SHA256 export signatures, and KMS/HSM-held keys, in line with **NIST FIPS 180-4** and **FIPS 198-1**. * **Least privilege** — export requires the `audit_view` capability; full chain verification is restricted to Owners. > These controls describe how Enclave's audit subsystem is engineered. For Kvelden's organisational certification and attestation status, see [Compliance](/enclave/compliance). ## Exporting logs Exports are available at **Settings → Audit Log → Export**: * **Format** — CSV, with a cryptographic signature block appended as a trailer * **Date range** — filter by start and end date * **Event types** — filter by action category * **User** — filter by specific actor Exports are signed. The appended block carries the KMS-wrapped key and the HMAC covering every row, so a verifier can confirm the file is both complete and unaltered. ## Real-time delivery Audit events can be delivered in real time to external systems via two mechanisms: * **Webhooks** — HTTP POST to any HTTPS endpoint, HMAC-signed, with automatic retries. Managed at **Organisation → Webhooks**. [Learn more →](/enclave/webhooks) * **SIEM Forwarder** — syslog (RFC 5424) or CEF over UDP/TCP for on-premise deployments that cannot accept inbound HTTPS. Configured at **Organisation → SIEM Settings**. [Full webhooks reference →](/enclave/webhooks) ## Security alerts Audit events also feed into Enclave's alerting engine: * **Policy alerts** fire when specific audit actions occur (room deleted, role changed, KMS unassigned) * **Behavioral anomaly detection** fires when a user's file-access pattern crosses a threshold (bulk downloads, new country, off-hours access) Both write to the **Security → Alerts** dashboard and notify Owners and Security Officers. [Learn more about security alerts →](/enclave/security-alerts) ## Retention | Tier | Retention | Notes | | --------------- | --------- | ---------------------------- | | Hot (queryable) | 90 days | Full search and filter in UI | | Cold (archived) | 7 years | Downloadable exports only | Retention periods can be extended on request for regulatory requirements. Logs cannot be shortened below 7 years for SOC 2 Type II compliance.