Audit logs and security

The audit console

Audit Logs & Security lives at /app/admin/audit and has three tabs: the access log, network access rules, and sovereign extensions. This article covers the access log and the compliance exports. Network rules and the sovereign tab have their own article.

What the access log shows

The access log is your workspace's record of access-control events: denied sign-in attempts under IP restrictions, every change to your IP rules, every flip of the enforcement toggle, and every change to a sovereign extension switch. Each entry shows the event type, when it happened, who acted, and the network address involved.

The log is append-only and hash chained: each entry commits to the one before it, so removing or altering an entry afterwards breaks the chain and becomes detectable. That makes the log tamper-evident. It is a record you can check, not a record nobody could ever touch.

The IP column

The address shown is the one Exedra Gate's servers resolved for the connection at the time, not one reported by the browser. For a denied attempt it is the address that was checked against your rules, so you can see exactly which network the attempt came from and add a rule for it if it was legitimate.

What a denied entry means

An entry marked "IP access denied" means someone with a valid password and second factor signed in from an address outside your allowed networks, and the session was refused and revoked. The entry names the account and the address it came from. A denied entry is the control working; a run of them from an unfamiliar address is worth a look at who holds that account's credentials.

Entries marked degraded

Each entry is also signed and, where possible, independently timestamped. If signing or timestamping was unavailable at the moment an entry was written, the entry is still recorded with its hash chain intact and is marked degraded rather than being dropped or hidden. The chain is what makes tampering detectable; the mark tells you the signature or timestamp is missing for that entry.

Compliance exports

Below the access log you can generate exports for auditors and regulators: a combined compliance bundle, the system audit trail as CSV or JSON, document access logs, KYC case exports, and signing status. Exports are point-in-time snapshots; generate them fresh when an auditor asks, and filter by date range where offered.

What the evidence establishes and what it does not

The logs and exports show what happened in your workspace: who acted, when, from which resolved address, and that the record has not been altered since it was written, backed by hash chains, signatures and independent timestamps where present.

They do not establish who was physically at a keyboard, whether a credential was shared, or anything about events outside Exedra Gate. An address tells you the network a connection used, not the person behind it. Treat the log as strong evidence of what the system did and refused to do, and combine it with your own account hygiene for the rest.