COMPLIANCE

Immutable Audit Trail

Every authentication event — every login attempt, code sent, session started, or access revoked — is written to a permanent log that cannot be modified or deleted. Search by user, IP, event type, or date range. Export for compliance audits. 90 days of history kept automatically.

Immutable90-day retentionIP loggingUser-agentAdmin queryNFT events

01

Something happens

Any auth activity — login, code, wallet, token, or NFT event — writes a log entry immediately.

02

Full context saved

Each entry records who, what, when, from where, and whether it succeeded or failed.

03

Cannot be changed

Logs are write-once. No one — not even admins — can edit or delete them.

04

Fast to search

Every entry is indexed so you can filter by user, date, action, or outcome instantly.

05

Admin dashboard

A live filterable view of all events. Spot anomalies or investigate incidents in seconds.

06

Export & comply

Download as JSON or CSV. Automatic 90-day cleanup. Ready for SOC 2 and GDPR audits.

What Gets Logged

Every significant event: successful and failed logins (email, wallet, OTP), token issuance and revocation, refresh token rotation, backchannel logout, nonce generation and consumption, NFT mint and burn, encrypted record creation, threshold session events, and admin actions. Each log entry captures: tenant, user, IP address, user-agent, timestamp, event type, and outcome.

Compliance & Retention

Audit logs are append-only — no update or delete operations are permitted on log entries. 90-day retention is enforced by automated cleanup jobs. Logs can be exported in JSON or CSV format for SIEM integration. SOC 2 and GDPR audit requirements are met out of the box.

← Previous

Organizations & Sub-Organizations