Audit Log

Overview

What does Audit Log mean?

Audit Log is a chronological record of security-relevant and operational events that shows who or what performed an action, when it occurred, and what changed.

How it works in practice

An audit log records who or what performed a security-relevant or business-critical action, when it occurred, its outcome and the object changed. In payment systems, useful records include API key changes, invoice edits, refund approvals, payout creation, overrides and webhook processing. Each event should carry a reliable timestamp, actor or service identity, request ID, target and safe before-and-after details where appropriate. Logs need restricted access, tamper-evident storage, retention policies and enough time synchronization to reconstruct a cross-system incident.

Further operational details

Audit Log is a chronological record of security-relevant and operational events that shows who or what performed an action, when it occurred, and what changed. Its operational purpose is to support accountability, incident investigation, control monitoring, troubleshooting, and regulatory or contractual evidence. The relevant distinction is general application logging, which may include diagnostic messages that are useful for engineering but are not necessarily complete, protected, or suitable for audit evidence.

Implementation of Audit Log should map a chronological record of security-relevant and operational events that shows who or what performed an action, when it occurred, and what changed to the applicable entity, product, customer, transaction, and jurisdictional scope. Material changes affecting the Audit Log context and what performed an action, when it occurred, and and what changed should trigger reassessment instead of silent reuse of an outdated conclusion.

Limits and common misunderstandings

An application log full of debug text is not automatically a trustworthy audit trail. If staff can alter or delete audit events without leaving evidence, later investigations are compromised. Secrets and personal data should not be indiscriminately copied into logs.

Related glossary terms

Auditability; Financial Sanctions; Merchant Risk Assessment