Audit logs and access control: what actually matters for compliance
Most audit trails record the wrong things. Here is what an auditor, a client or a regulator actually wants to see — and how encryption changes the design.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.
What a log is for Not to satisfy a checkbox, but to answer three questions after the fact: who had access, when did that change, and what did they do with it. A log that cannot answer those is decoration, however voluminous.
The events worth recording - **Grants and revocations** of access, with actor, subject and timestamp. - **Key rotations**, which are what make a revocation meaningful. - **Share-link lifecycle**: creation, parameters, first use, expiry, revocation. - **Access events** on protected resources. - **Authentication events**: new device, new location, step-up verification, session revocation. - **Administrative changes**: seats, roles, organisation membership.
Properties that make a log credible **Append-only.** If administrators can edit or delete entries, the log proves nothing about administrators — who are precisely the population an auditor worries about.
Content-free. A log should record that a document was accessed, not what it contained. Otherwise the log becomes a second, less protected copy of the sensitive material.
Exportable. You will need to hand a subset to a client, an insurer or an investigator without granting access to the system.
Time-consistent. Correlation across events is the entire analytic value.
How zero-knowledge changes the design Because the provider cannot read content, logging is necessarily about access and structure rather than about what was inside. That is a feature: the audit trail is intrinsically minimised, and it cannot become a leak channel. It also means your log will not tell you which paragraph someone read — a limitation you should state up front to auditors rather than discover in an assessment.
Access control worth logging Logging is only as meaningful as the access model underneath. In a permissions-table model, a log records intent while the underlying capability persists. In a key-envelope model, access is possession of a sealed key, so a revocation entry corresponds to an actual cryptographic change: rotation of the remaining envelopes.
A monthly routine that keeps you honest 1. Review live external links; revoke anything past its purpose. 2. Review membership of every sensitive space. 3. Review active sessions and trusted devices. 4. Export the trail for closed matters and file it with the case or project record. 5. Confirm that every departure in the last month produced a rotation entry.
Thirty minutes a month produces the artefact that a client questionnaire, an insurer or a regulator will ask for — and, more usefully, catches the access that should have ended in March.
Try it in one click.
Three private surfaces. Same zero-knowledge architecture.