· Yair Knijn
The audit trail your SaaS vendor could quietly edit
The CISO signs the control questionnaire and writes "audit logging: yes." Every SaaS tool in the estate has an activity log. The CRM logs admin actions, the ticketing tool logs status changes, the HR app logs who pulled which record. Tick the box, move on.
The wrong assumption is that those logs are an audit trail. They are activity feeds the vendor built for support and debugging, never designed to survive a dispute. The day you need them to prove what happened, you find out they were mutable, short-lived, and trapped inside each product.
Mutable, short-retention, siloed: what per-tool logs really are
Open any vendor's activity log and ask three questions. Can an admin with the right role delete or alter an entry? Usually yes, sometimes through support without a paper trail. How long is it kept? On a lot of plans the answer is 90 days, with longer windows behind an enterprise tier or a SIEM export you wire up yourself. Where does it live? Inside that one product, in that vendor's schema, reachable only through that vendor's console.
Multiply that by the dozen tools a regulated team actually runs and you do not have an audit trail. You have a dozen feeds, each on its own clock, each editable by someone, each ending when the retention window rolls over. None of them can prove that what you show the auditor is everything that happened.
Why append-only and tamper-evident are control requirements, not nice-to-haves
Non-repudiation is the actual control: a definitive record tying a specific action to a specific identity at a specific time, that the actor cannot later deny and nobody can quietly rewrite. A mutable table does not clear that bar. A SOC 2 auditor wants proof that no record was deleted, and a record an admin can edit proves nothing. No retention period is universally mandated, but auditors commonly expect around twelve months, which a 90-day vendor log cannot give you.
The mechanics that deliver tamper-evidence are worth naming, because "we keep logs" does not describe any of them:
- Append-only storage —
INSERTonly, noUPDATEorDELETEon the trail, enforced at the data layer rather than by policy. - Hash chaining — each entry carries a hash of the previous one, so altering or removing any record breaks the chain and the tampering is detectable on verification.
- WORM backing — write-once-read-many storage such as S3 Object Lock or Azure immutable blob, where deletion is blocked at the infrastructure layer, not by a setting an admin can flip.
Centralizing activity into one immutable record across products
The fix is not turning on logging harder in each tool. It is moving the authoritative trail out of the products into one append-only record that every product writes to and no product can edit. The vendor feeds stay where they are for debugging. The thing you hand a regulator is the central record, hash-chained and write-once, with one retention policy you set rather than twelve you inherit.
This also kills the cross-product blind spot. When an admin changes a permission in one app, exports data from another, and closes a ticket in a third, the central trail captures all three in one ordered stream against one identity. You stop reconstructing a timeline from ten exports and start reading one.
What forensic readiness and non-repudiation actually demand
Forensic readiness is a quiet promise that on the worst day, the data scoping out an incident is complete, ordered, attributable, and provably unaltered. A trail spread across a dozen mutable per-vendor logs fails on every count: incomplete the moment one window expires, unordered across systems with different clocks, unprovable because any record could have moved. You will not learn that on a calm Tuesday. You learn it when a regulator or a plaintiff asks you to stand behind the record and you cannot.
Spot Suite keeps the audit trail on the same append-only record per customer that identity and billing hang off, so every product in a Customer Environment writes to one immutable, hash-chained log instead of a dozen editable feeds. When the question comes, the answer is one export you can stand behind, not ten you have to defend. The mechanics are on the security page.