Audit Log (Audit Trail)

An audit log is an append-only record of security-relevant events in your app — who did what, to which resource, and when. Logins, permission changes, data exports, deletions, and admin actions each become an immutable entry with actor, action, target, and timestamp. For SaaS builders, audit logs serve two audiences. Your customers' security teams want them to investigate incidents and prove compliance, so an exportable or streamable audit trail is a common enterprise requirement and a differentiator on higher-tier plans. Your own SOC 2 audit also depends on logging administrative access. Practical note: audit logs are not the same as debug logs — they must be tamper-resistant, retained for a defined period, and never contain secrets or full PII payloads. Capture them at a chokepoint (a service layer or middleware) so events aren't silently missed, and record the actor's identity, not just an internal ID. Design the schema early; backfilling history you never captured is impossible.