Audit Trail

Immutable, tamper-proof log of every action taken in Matproof — who did what, and when.

Overview

Matproof’s Audit Trail (/[orgId]/audit-trail) records every action taken across your compliance program in an immutable, tamper-proof log. This gives you full visibility into platform activity and provides the evidence trail that regulators and external auditors expect.

Audit trail entries cannot be edited or deleted. This is by design — any modification would compromise its integrity as evidence.

What gets logged

Every significant action in Matproof creates an audit trail entry:

Category	Actions captured
Policies	Created, updated, published, reviewed, archived
Evidence	Uploaded, linked to control, deleted, expiry changed
Controls	Status changed, owner reassigned, framework mapping updated
Users	Invited, role changed, removed
Vendors	Added, risk assessment updated, removed
Settings	Organisation settings changed, SSO configured, integrations added
Audit programs	Created, finding logged, report generated
Risk register	Risk created, score updated, treatment changed

Each entry records:

• Timestamp — exact date and time (UTC)
• User — who performed the action
• Action type — what they did
• Object type — what was affected (policy, control, user, etc.)
• Object ID — the specific record
• Details — before/after values where applicable

Filtering and searching

Use the filter bar to narrow the audit trail:

Filter	Options
Date range	Custom start/end date
User	Filter by specific team member
Action type	e.g. evidence_uploaded, control_status_changed
Object type	Policy, Control, Evidence, User, Vendor, etc.

You can combine filters — for example, show all evidence uploads by a specific user in the last 30 days.

When preparing for an external audit, filter by date range and export the relevant window. Auditors typically want to see activity for the period under review.

Exporting for auditors

The full audit trail — or any filtered view — can be exported as CSV.

To export:

1. Apply any filters needed to scope the export
2. Click Export CSV in the top right
3. The file downloads with all visible columns: timestamp, user, action, object type, object ID, details

This CSV is commonly requested by:

• DORA supervisors during ICT risk examinations
• ISO 27001 certification auditors reviewing access and change controls
• Internal audit teams conducting periodic reviews

Data retention

Audit trail data is retained for a minimum of 5 years.

DORA Art. 12 requires financial entities to retain logs for a minimum of 5 years. ISO 27001 Annex A 8.15 requires logging and monitoring of system activities. Matproof’s default retention satisfies both requirements.

Why it matters for compliance

DORA (Digital Operational Resilience Act)

DORA requires financial entities to maintain logs of ICT-related activities and provide them to competent authorities on request. The audit trail covers ICT risk management actions, user access changes, and system configuration events.

ISO 27001 Annex A 8.15 — Logging

ISO 27001 requires that logs record user activities, exceptions, and information security events. The audit trail provides this evidence across your compliance program operations.

ISO 27001 Annex A 8.16 — Monitoring activities

The ability to filter, review, and export activity logs supports the monitoring controls required under ISO 27001.

If you are subject to DORA examination, regulators may request the audit trail for a specific time window with short notice. Keep exports current and make sure your team knows how to generate them.