How to Build a Secure Audit Trail in Your Web App (No Third-Party Tools)
I never cared for audit trails too much until we did our first compliance review on a healthcare project I was working on. The first question asked of the auditor was:
Please provide me with everything you did to this record in the last 90 days.
We could not. Not properly, anyway.
At that point, I made logging not an afterthought. When you are building anything that involves some sensitive data, your builds could be in healthcare, or maybe finance, or perhaps internal admin tools — you need a real audit trail. Not some console. queryable, a tamper-resistant log of who did what and when —log wrapper.
