An auditor rarely asks whether you keep logs. They ask what happened to one specific request, and whether anyone could have changed the answer since. Most teams can produce evidence for the first question after two days of joining data, and nothing at all for the second.
What it changes for the business
- A regulator's question becomes a lookup. One identifier returns the whole sequence in order, so the answer takes minutes and does not need an engineer.
- Your evidence survives being challenged. You can demonstrate the record was not altered, rather than assert that your platform would not allow it.
- Incident review starts at the facts. What was requested, what policy decided, what was substituted, who approved it, what actually went out.
- The audit is not a separate build. It comes from the same path that enforces policy, so there is no second system to fund, integrate and reconcile.
How it works, briefly
Every decision and outbound call is written to an append-only record in which each entry depends on the one before it. Any alteration breaks that dependency, and the integrity check that detects it is something you run on demand.
| How this is handled elsewhere | How Squidder does it |
|---|---|
| Observability tools: traces you can edit or lose | A record that shows if it has been touched |
| Retention policy as the compliance answer | Proof, on demand, that nothing changed |
| Logs per service, joined by hand during an incident | One identifier, one sequence, in order |
| LLM calls only | Web, model and agent traffic in one record |
| Secrets end up in the log | The secret was never in the path to be logged |
Where it fits, and where it does not
The record proves what was decided and what left. It is deliberately not a copy of your data: it carries the structural trace, never the underlying secret, which is what makes it safe to keep for as long as your regulator wants it kept.
Where to start
Take a request from last week and ask your current tooling what happened to it, end to end, and whether anyone could have edited that answer. Time how long it takes to get both.