Audit log and data trail

Customer, order, product, broadcast, ticket, and permission mutations all write structured audit events: what changed, who changed it, when, and from where.

The log is append-only by construction. The API has no update or delete routes for audit events. History is not negotiable.

Every row carries organization_id and every query is org-scoped through the principal system. Isolation tests run on every change to the codebase.

The kit includes backup scripts and restore validation, but the desktop app does not provide self-service workspace export. No customer-hosted production instance has been provisioned or validated. Confirm retention and exit terms before onboarding.