Audit ledger — the append-only, hash-chained audit trail, integrity verification, and court-ready evidence
Last updated: July 30, 2026 by Steve
Audit Ledger
The Audit Ledger is AccessPoint's tamper-evident record of every significant action taken in your tenant. It is append-only and hash-chained: each entry is linked to the one before it with a SHA-256 hash, so the ledger can prove it has not been altered after the fact. That makes it the evidentiary backbone for court-ready audit and disclosure defensibility.
Where to Find It
Open Settings from the app toolbar and choose Audit ledger in the System & compliance group.
What the Panel Shows
| Element | Shows |
|---|---|
| Total entry count | The number of entries currently in the ledger. |
| Recent entries | The most recent actions, each with timestamp, actor, category/action, affected entity, and reason. |
| Verify integrity | The action that walks the hash chain server-side and reports whether the ledger is intact. |
Verifying Integrity
The Verify integrity action walks the SHA-256 chain on the server and reports one of two results:
- Green — the chain is intact end to end; no entry has been altered.
- Red, with the first broken entry id — a row has been tampered with, and the id tells you where the chain first fails.
Append-Only and Hash-Chained
- Entries are never edited or deleted — the ledger only ever grows by appending.
- Each entry's hash incorporates the previous entry's hash, forming a chain. Altering any past row changes its hash and breaks every hash after it, which Verify integrity detects — this is what makes the record tamper-evident rather than merely a log.
Court-Ready Evidence
Because the chain is independently verifiable, the ledger lets you demonstrate that your record of who did what, and when, is complete and unaltered. That defensibility is what makes it suitable as evidence in an appeal, investigation, or court proceeding — you can produce the trail and prove its integrity in the same step.
AI Involvement Disclosure
When the optional AI Assist capability is deployed, every generated case audit export (formerly "evidence package") includes an ai-involvement.json disclosure alongside the exported records. It records exactly which AI features touched the case, how much, and what a human decided at each step — so the package can stand on its own about where AI was, and was not, involved.
Prompt and response content is never retained anywhere; the disclosure carries only usage metadata. Because every AI output was a suggestion or an editable draft that a person accepted, edited, or rejected, the disclosure makes that human decision record part of the defensible trail.
Related
The audit ledger is tenant-wide. For the history of a single request, the per-request Activity tab shows that request's status transitions and user actions in context.
Tips
- Run Verify integrity before producing the ledger as evidence, so you can attest the chain was intact at the time of disclosure.
- The reason captured on each entry is part of the record — encourage staff to record meaningful reasons on actions that prompt for one, since they become part of the defensible trail.