Audit log

Vaultigen keeps an application append-only, tamper-evident audit log. Super Admins and Auditors read it under System → Activity.

What is recorded

Sign-ins and failures, factor changes, user and team administration, grant changes, every secret delivery and attachment download, imports, key rotation, backup and restore, emergency access, denied high-risk actions, decryption failures, security setting changes, audit viewing, and pruning.

Each event has an actor, action, outcome (success, denied or failed), source (web, console, queue, scheduler), the vault and target, and a small redacted context.

What is never recorded

Passwords, TOTP seeds or codes, private keys, recovery codes, encryption keys, ciphertext, request bodies, complete URLs, imported source rows and file contents.

Reveal and download endpoints fail closed: if the audit event cannot be written, the value is not delivered.

How tampering is detected

• Events are encoded canonically and linked in a SHA-256 hash chain: changing or deleting an earlier event breaks every later hash.
• Each event also gets an HMAC checkpoint made with the audit-integrity key, which lives in installation.json, outside the database.

The Activity page shows the verification result for the whole chain (“Audit chain verified”), the number of events and checkpoints, and the last pruned range. Someone who rewrites the database without the audit key cannot produce valid checkpoints.

The log is tamper-evident, not immutable. An attacker who controls the application and the audit key can rewrite local history. Keep the audit key in your escrow, separate from the server.

Using the Activity page

Filter by actor, action, outcome, time period, vault and source channel. The details view shows the target, the redacted context, the canonical event and, to installation managers, the IP address and user agent. Opening the page itself is recorded as audit.viewed.

Auditors see the installation-wide log with actor contact details redacted. They cannot open vault contents from there unless they separately hold a vault grant.

Retention and pruning

Under Settings → Audit retention:

Setting	Default	Meaning
Audit retention	365 days	Events older than this may be pruned (1–3650 days).
IP and user-agent retention	30 days	IP addresses and user agents are redacted after this. 0 keeps them for the life of the event.

Pruning runs daily at 03:30 through the scheduler, and a Super Admin can start it with Prune audit log. Before deleting old events, Vaultigen writes a keyed checkpoint for the removed range and records an anchor, so the surviving chain still verifies. The prune itself is recorded as audit.pruned.

IP addresses and user agents are stored outside the hash chain, so redacting them for privacy never breaks verification.