Arrivals and departures
Who arrived, for whom, at which door, what they were asked and what they answered, when they left, and who checked them out if they did not do it themselves.
The record
Written once. Checkable forever.
A visitor book can be rewritten with a pen. A database row can be updated by anyone with the password. The question an auditor is really asking is not "what does it say" but "how would you know if it had been changed".
Audit log
How it works
Each row carries the hash of the row before it.
Rows are only ever appended. Every one is hashed together with the hash of its predecessor, so the log is a chain: change a row, remove one from the middle, reorder two, and every hash from there on stops matching.
The console verifies the chain — at start-up, every few minutes, and on demand — and shows the result where the people who work there will see it, not only where a script would. On the hosted service the account that serves your site is refused UPDATE and DELETE on the log by the database itself, so the software cannot rewrite history even if it were told to.
We call that tamper-evident, not tamper-proof, and the difference matters: someone with direct access to the database file can still alter it. What they cannot do is leave it looking untouched. Keep an exported copy off the machine — the product's own guidance says the same thing, in the same words.
08:12:44visit.create9d41…07bc
08:12:45screening.hit2ca8…5e19
08:19:02screening.releasedb774…31d0
08:19:03agreement.signed45ef…c8a2
12:41:20rollcall.start7f02…9b6e
12:48:57rollcall.ende1bd…4402
What is in it
Everything that touched the door, in plain words.
The log is written for the person reading it under pressure, not for a developer: sentences, not event codes.
Screening decisions
Every match, what it matched against, who released the hold and the reason they gave — and the ones that cleared without anybody having to look.
Signatures
Which agreement, which published version, signed by whom and when, with the hash of the document as signed.
Roll calls
Who started it, everyone on it, every mark and who made it, anyone who arrived while it was open, and who ended it.
Administration
Agreements published and retired, questions changed, users added, two-factor resets, settings altered — with the account that did it.
Access to the data itself
Exports taken, photographs viewed, and any support engineer who looked inside — on your log, not just ours.
Audit log · filtered
Handing it over
What the auditor actually leaves with.
- The visits, as a spreadsheet for the range and the kind of arrival they asked about, with the questions asked and the answers given.
- The signed agreements as PDFs, each one the document as it stood when it was signed.
- The roll call from the day of the drill, or the day it was not a drill.
- The fact that they took it. An export is an event like any other: it is written to the log with the filters used, the number of rows, and the state of the chain at that moment.
- The hashes themselves. The audit export carries each row's hash and the one before it, and how to recompute them is written down — so the arithmetic can be redone without taking our word for it.
Every cell of an export is written so that a spreadsheet cannot be made to run it: a visitor who types a formula into their company name gets a company name, not a macro on the auditor's laptop. The hashes and timestamps are left exactly as they are, so the seal still recomputes.
Keeping it, and not keeping it
Retention is a policy, not an accident.
You set how long
Visits, photographs and signed agreements each have their own life. What has passed its date is removed on a schedule rather than sitting there until someone remembers, and the removal is itself recorded.
The record outlives the subscription
A signed agreement is evidence of something that happened. If you stop being a customer, the obligation to have kept it does not stop with the invoice, and we do not delete it to tidy up.
See it against your own procedure.
Bring the questions your last audit asked. That is the fastest way to find out whether this fits.