Audit trail

Everything privileged that happens in eworks.cloud produces an immutable audit event, searchable in e.audit at https://audit.eworks.cloud.

What is audited

Every event carries: event ID, UTC timestamp, workspace ID, actor (user or service identity), actor IP and user agent, target resource, action outcome, request ID for correlation, and a payload digest.

Prompt and response bodies are not written to the audit trail — only metadata and a content hash — so the log can be shared with auditors without exposing workspace content.

Retention

Audit events are retained 7 years in a dedicated compliance store, hot and searchable for the entire window. Retention is a floor, not a ceiling that customers can lower: shortening it would break SOC 2 CC7.1 and LGPD Art. 37 evidence obligations.

Immutability

• The compliance store is append-only. There is no API, console action or support procedure that edits or deletes an event.
• Each event is chained to the previous one with a SHA-256 digest, so any gap or alteration is detectable.
• A daily digest anchor is published to a separate account that the application has no write access to.
• Workspace deletion pseudonymizes subject identifiers inside retained events; it does not remove the events.

Encryption

Audit events are encrypted at rest with AES-256 using a key distinct from the application database key, and in transit with TLS 1.3. Export bundles are encrypted and delivered through short-lived signed URLs that expire after 15 minutes.

Querying the audit log

In the UI: filter by date range, category, actor, target, outcome and IP; save filters as views; subscribe a view to a digest email.

Via the API:

curl -s "https://api.eworks.cloud/v1/audit/events?\
category=admin&action=member.role_changed&\
from=2026-08-01T00:00:00Z&to=2026-09-01T00:00:00Z&limit=100" \
  -H "Authorization: Bearer $EWORKS_TOKEN" | jq '.data[] | {timestamp, actor, target, outcome}'

import requests

def audit_events(token, **params):
    url = "https://api.eworks.cloud/v1/audit/events"
    cursor = None
    while True:
        r = requests.get(url, headers={"Authorization": f"Bearer {token}"},
                         params={**params, "cursor": cursor, "limit": 500}, timeout=30)
        r.raise_for_status()
        page = r.json()
        yield from page["data"]
        cursor = page.get("next_cursor")
        if not cursor:
            break

failed = [e for e in audit_events(TOKEN, category="authentication",
                                  action="auth.login.failed", **{"from": "2026-09-01T00:00:00Z"})]
print(len(failed), "failed logins")

Against a warehouse export, the same question in SQL:

select actor_email,
       count(*) as failures,
       min(occurred_at) as first_seen,
       max(occurred_at) as last_seen
from audit_events
where category = 'authentication'
  and action = 'auth.login.failed'
  and occurred_at >= now() - interval '24 hours'
group by actor_email
having count(*) > 5
order by failures desc;

Export and DSAR compliance

DSAR bundles combine subject profile, content and audit events into a single archive, generated in under an hour and delivered within the 7-day SLA. Each export is itself an audit event (dsar.exported), so evidence access is auditable.

Real-time alerts

Alerts can be routed to email, webhook or a SIEM connector configured in e.dash.

Next

• Incident response
• Audit review walkthrough