Trust & Security

Tenant logging: the immutable record

A dedicated, append-only history of what happened — built so it can be verified, not just trusted.

Every application's history lives in its own dedicated logs database, physically separate from live data. That separation is the first guarantee: heavy operational work can't disturb the record, and the record's growth can't slow the application. The rest of the guarantees are about what “immutable” actually means here.

Append-only by design

The logs database is written to in exactly one way: new entries are appended. There are no update paths and no delete paths in the writing surface — history accumulates; it is never revised. Field-level access logging captures reads of sensitive data, not just writes, at a compliance grade suitable for regulated industries.

Tamper-evident, not just tamper-resistant

For the most sensitive log families — AI data retrievals and third-party disclosures — append-only isn't considered enough, because append-only is a promise about behavior. These logs are hash-chained: each entry's fingerprint folds in the fingerprint of the entry before it, per tenant, so the entire history forms one continuous cryptographic braid. Alter, insert, or remove any entry anywhere in the chain and every subsequent fingerprint stops matching.

The consequence is the property that matters to an auditor: tampering isn't merely prohibited, it's detectable by arithmetic. A chain verification walks the history recomputing every link and reports the first break, if any exists. Trust becomes something you can check.

Isolation between contexts

The logs database holds no security tables and makes no access decisions of its own — it accepts pre-resolved, pre-authorized entries from the platform layer, keeping the record's integrity concerns cleanly separated from live authorization concerns. Chains are maintained per tenant, so one tenant's history is cryptographically independent of every other's.

What this buys you in practice

• Dispute resolution — “who saw this and when” has a definitive answer.
• Compliance evidence — an access history whose integrity can be demonstrated, not asserted.
• Foundation for replay — because the history is trustworthy, past security decisions can be re-examined against it. That's the next page: replayable authorization.
• Tenant-owned analytics — because the history is append-only, each tenant can export their own workspace's history, incrementally and cleanly, to their own Snowflake warehouse. See Snowflake analytics sync.

Capability review: 2026-09-14. For exact current technical availability, use the generated API Map and first-class module inventory.