Every action on the record. The record doesn't change.

A case opened, a label applied, a reply sent, an answer given, a record linked, a setting changed, a legal hold placed, an export taken — each is one event on the organization's own sequence, with who did it (a person, the assistant, an integration key, the public) and the request's trace id.

Each event carries a SHA-256 hash computed over its content and the previous event's hash. Change one byte of any past event and every hash after it stops matching. The events table refuses updates and deletes at the database level; in production the grants are revoked as well.

The audit log is a tab in the workspace, not a support ticket to us: filter by kind, resource, actor, trace id or time; page through it newest first; export a range as CSV or JSON. A read-only auditor role sees the log and nothing else — and reading or exporting the log is itself an event.

A verification endpoint walks the whole chain and reports the first event, if any, whose hash does not match. It is the same check the tests run after deliberately tampering with a row, so "the chain verifies" is a statement about the data, not about trust in us.

Each night the next contiguous range of events is written as a file to your S3-compatible bucket, and a ledger row records the range, the file's SHA-256 digest and its size. The digest is also written to the chain as an event, so the following night's export carries the proof of the previous one. The chain can be re-verified from the files alone, without Serviceplane.

The search the assistant ran, the passages it retrieved, the answer it gave and the model that gave it share a trace id — and the operational log line for the same request carries it too. A reviewer sees the whole chain of reasoning without reconstructing it.

When a staff member tells the copilot "assign this to Billing and mark it high priority", the resulting events are attributed to the copilot acting on that person's instruction — the instruction text rides on every one. Anything outbound, a reply or an email, is held for the person's click and recorded as confirmed.

A retention policy blanks message content on schedule — chat text, transcripts, email bodies — and stamps when it did. Rows, cases, counts and the events themselves stay, so an audit of what happened survives the deletion of what was said. A case on legal hold is skipped entirely.

For a public records request or a complaint review: one export holds the case, the person, every chat turn, email, text, note and attachment record, and the case's own audit trail with hashes — as text or JSON. Taking the export is, of course, an event.