Your immutable audit log, explained
G8KEPR records every security-relevant action in a tamper-evident audit log. It's the backbone of the compliance and audit surface — the record you hand an auditor to show what happened, when, and who did it.
What gets recorded
The audit log captures the events that matter for security and compliance reviews:
- ▸Sign-ins, sign-outs, and failed authentication attempts
- ▸Configuration and policy changes (rules, thresholds, enforcement mode)
- ▸Threat detections and blocks across the four pillars
- ▸MCP tool calls and the decisions made on them
- ▸API key creation, rotation, and revocation
- ▸Team, role, and permission changes
- ▸Publishing an answer to the Help Center
Each entry carries a timestamp, the acting user or API key, the organization, and the affected resource.
How tamper-evidence works
Entries are linked together in a hash chain: each record includes an HMAC-SHA256 hash that incorporates the previous record's hash. Because every entry depends on the one before it, editing or deleting any entry after the fact breaks the chain from that point forward — which makes tampering detectable rather than silent.
This is what lets you demonstrate integrity to an auditor: not just "here are our logs," but "here is cryptographic evidence the logs weren't altered."
Reviewing and retaining it
You can review recent activity from the dashboard and export ranges for archival or auditor review (see Exporting compliance evidence). Retention depends on your plan and deployment — in a self-hosted VPC, the log lives in your own PostgreSQL instance under your retention policy.
Tenant isolation applies to the audit log like everything else: you only ever see your own organization's entries.