Postgres-level triggers block UPDATE and DELETE on audit tables; the platform has no API surface that can alter a historical entry. What happened, happened — and the record proves it.
Each event carries actor, role, action code, entity reference, IP, user-agent, and a payload snapshot of the state-change. Filter by any combination. Investigate anything.
Export a period-scoped audit bundle as a formatted PDF for auditors or a CSV for analysts. Every export itself is logged, so you always know which auditor received which snapshot.
Separation of duties, role-based access control, immutable trails, and time-bound access grants — all part of the platform architecture. No bolt-on compliance theatre.
When an auditor asks for "all approvals in Q3 over ₦1M", a saved-view + export delivers the answer — with signatures, chains, and timestamps — before the meeting starts.
A vendor's bank details changed between submission and payment. Audit shows who changed it, when, from which IP, and what the previous values were. No Slack archaeology.
If a fraudulent approval is ever attempted, the audit trail is complete and unalterable. Security teams have a forensic source of truth on day one, not the scattered evidence they usually inherit.
Monthly and quarterly exports feed board packs with volume, turnaround, and exception data — pulled from the trail, not hand-assembled from spreadsheets.