What is an audit trail?
An audit trail is an immutable log of significant actions taken within your app — who did what, to which record, and when. Every create, edit, delete, approval, and login is recorded in a way that cannot be modified or erased after the fact.
This serves two purposes. First, operational: when something goes wrong ("who deleted that client record?", "when was this invoice last edited?"), the audit trail gives you a definitive answer. Second, compliance: regulated industries — financial services, healthcare, legal, government — often require documented evidence that data was handled appropriately, approvals followed process, and access was controlled.
An audit trail is distinct from application logging (which records technical events for debugging) and from an analytics dashboard (which aggregates business metrics). It's the forensic record of human actions on your data.
When does your app need it?
- Your app is used by multiple staff members who can edit or delete shared records — you need accountability
- You operate in a regulated industry (financial services, NDIS, aged care, legal) that requires documented evidence of actions and approvals
- Your app handles sensitive personal data under the Australian Privacy Act and you need to demonstrate data access was appropriate
- Users need to see the history of a record ("this quote was edited three times — here's each version") as a standard workflow feature
- Your app manages approvals or multi-step processes where an audit record of each stage is required
- You've had data integrity incidents and need to investigate root causes or restore to a known state
How much does it cost?
Adding an audit trail typically adds 5–11 hours of development — roughly $1,000–$2,000 AUD at Australian boutique agency rates.
A lightweight implementation (middleware that logs every write operation, searchable by admin) sits at the lower end. A full implementation — with user-facing activity feeds per record, before/after field-level diffs, search by user/action/date, export for compliance review, and per-entity history timelines — sits at the upper end.
How it's typically built
The most common approach is middleware or a database trigger that intercepts write operations and records them to a dedicated audit log table. Each log entry captures: entity type (e.g., "Invoice"), entity ID, action (created/updated/deleted), the user who performed the action, timestamp, and optionally a JSON diff of changed fields.
The audit log table is append-only by design — rows are never updated or deleted. In sensitive deployments, this is enforced at the database level with row-level security.
For user-facing activity feeds (showing a timeline of changes on a specific record), a query retrieves all audit events for that entity ID and presents them as a history list. For admin-facing audit log search, a filterable table (by user, action type, date range, entity type) surfaces the full log.
Compliance exports are typically CSV or PDF downloads filtered to a specific date range, user, or record — provided to auditors or included in regulatory submissions.
Questions to ask your developer
- Which actions need to be logged? Not every event matters equally — define upfront what's "significant" (writes, deletions, logins, approvals) versus noise.
- Do you need field-level diffs, or just "record was edited"? Field-level diffs (showing exactly what changed from old value to new value) are more useful but require more storage and a more complex implementation.
- Is the audit log user-facing, admin-facing, or both? A user seeing the history of their own records is a different feature from an admin searching all activity — scope which you need.
- What are your retention requirements? Some regulations require audit records to be kept for five or seven years. This affects storage costs and database design.
- Do you need tamper-evident logging? For the highest compliance requirements, log entries can be hash-chained so any modification is detectable — this is a more complex implementation.
See also: Role-based permissions · Analytics dashboard · App cost calculator