The audit log
Every change in AssetTrove is recorded and chained so tampering can be detected. How to search, verify and export it.
AssetTrove records every change to assets, licences, people, roles and settings in the audit log, along with sign-ins and sensitive actions such as exports. You need the audit read permission (Owners, Admins and Auditors have it).
What each entry shows
| Field | Example |
|---|---|
| When | 12 Nov 2026, 18:04:40 |
| Who | licence.admin@example.com, or SCIM, System, Import |
| What | Hardware asset assigned |
| Which item | Laptop LT-0042 |
| What changed | Status: In stock → In use; Assigned to: nobody → Jane Doe |
| Where from | Web, API, SCIM, import or automatic job, with the IP address and request ID |
Secrets are never shown; they appear as [REDACTED].
Why it can be trusted
- No change without an entry. Each entry is written in the same database step as the change itself. If the change is saved, so is its entry. As an extra safety net, the database itself records any change made outside the normal route, and alerts us.
- Entries can't be edited or deleted. The database rejects it, whoever tries.
- Tampering is detectable. Each entry contains a cryptographic hash of the one before it, forming a chain. Changing any past entry breaks the chain.
- Anchored outside the database. Every hour, the latest position of the chain is written to write-once storage for seven years. Not even we can delete or overwrite it.
Verifying the chain
Select Verify on the audit log page, or use the API. AssetTrove recalculates the chain for the range you choose and compares it with the hourly anchors. The result is either intact, or the exact number of the first broken entry.
Exporting
Select Export to download the log as CSV or NDJSON (one JSON record per line), for example for your auditor or your SIEM. Exports need the audit export permission (Auditors have it), and every export is itself recorded in the log.
How long entries are kept
Entries are kept online for 400 days by default. Enterprise plans can keep them for up to 7 years. Older entries are archived, and the archive is anchored too.
Personal data
When a person is erased under the GDPR, their name and IP address are replaced with a pseudonym without breaking the chain. Changes to personal fields are stored in hashed form, so an auditor can still confirm that a field changed from one value to another.