Design an Audit Log Service
MediumSystem design · Compliance
Design an audit logging service for security-sensitive product events (for example sign-ins, permission changes, data exports, admin actions). The log must be tamper-evident, retained for years, searchable by tenants, and exportable for compliance.
In scope: durable append, tamper evidence, retention and legal holds, tenant-scoped search, export, and privacy requirements. Out of scope: general application logging and SIEM correlation.
Requirements
- No update or delete path for anyone, including administrators; corrections are new records
- Tamper evidence that an outside auditor can verify, via hash chains plus externally anchored roots
- Tenant isolation on reads, retention policies enforced by storage, and legal holds
- Acknowledge a write only after it is durably replicated; handle personal data erasure requests without breaking the chain