An audit trail that cannot be rewritten
Every action is written to the trail in the same transaction. The trail is append-only, enforced by the database and chained by hashes.
- Dr Petrov · Signed the form
- I. Morozov · SDV: verified against the source
- A. Smirnova · Changed the value72572.5Data entry typo
- System · Opened the query “Check the weight”
The essentials
Immutability is physical
The trail table is protected by database triggers against update, delete and truncate; the application’s runtime role has no right to bypass them.
Before, after and why
The trail keeps the value before and after, the author, their role and organisation at the time, and the reason. A saved value cannot change without a reason.
Completeness is checked by machine
A clinical change without a covering audit event fails the build’s test gate — a gap never reaches a release.
How to check integrity
- 01PackageA closeout or inspection package — with the audit trail and a manifest.
- 02ChecksumsThe SHA-256 of every file is checked against the manifest schema.
- 03Recompute the chainThe recipient recomputes the hash chain offline — without us.
Questions
Related regulations
How to set it up — in the documentation
Can an administrator fix a trail record?
No. The protection lives in the database itself; the application’s runtime role cannot change the trail.
Is reading data written to the trail?
Where reading is a risk in itself: for example, access to unblinded values writes a separate trail event.
See also
See the system on your own scenario
We walk through the full cycle on a demo study and answer your validation and hosting questions.