Platform · Module
Trust & Audit
Prove what happened, who did it and under which authority
Trust & Audit keeps a hash-chained audit trail per tenant, logs sensitive reads, handles data-principal requests, legal holds and incidents, and builds evidence packs. It is the evidence base for DPDP, CERT-In, SOC 2 and ISO 27001 work.
An audit trail you can verify
Every tenant gets append-only, hash-chained audit events. Each event carries a sequence number, the previous hash and its own hash, and is categorised as auth, access, data change, admin, policy, AI, billing, privacy or security. A verification job checks the chain and raises an alert if it ever breaks. The audit search screen filters by actor, actor type, object, category, time and channel, and shows a redacted before-and-after view.
Sensitive reads and exports
From Wave 1, reads of pii, sensitive_pii and restricted fields and every export are written to an access log. That answers the question regulators and customers increasingly ask: not just who changed this, but who looked at it.
Data-principal requests
The data-principal request workflow covers intake, identity verification, resolving the person across apps, access, correction, erasure and grievance requests, blockers such as statutory retention, legal hold or disputes, evidence, and a completion notice. A consent evidence view per person reads the shared consent records.
Holds, incidents and evidence
Planned for Wave 2: audit export as CSV or JSON with an integrity manifest; a legal hold registry that blocks retention and deletion jobs; an incident workflow with severity, containment, regulator and customer notification clocks (CERT-In window to verify) and post-mortem; evidence packs for SOC 2 and ISO audits; support-access session trail export; archiving to object storage after 13 months with restore; and Audit Q&A, which answers natural-language questions with citations to event ids.
Planned for Wave 3: SIEM streaming, a trust centre page per tenant or partner, DPIA templates, consent manager integration and scheduled data export. External notarisation of chain heads follows in Wave 4.
Regulatory references here are pointers, not legal advice. Verify obligations with counsel.
Features
What Trust & Audit includes
Hash-chained audit events
Append-only events per tenant with sequence, previous hash and row hash across nine categories. W0.
Audit search
Filter by actor, actor type, object, category, time and channel; redacted before and after. W0.
Chain verification
Scheduled verification job with an alert on any break. W0.
Access logs
Reads of sensitive fields and all exports are logged. W1.
Data-principal request workflow
Intake, identity verification, cross-app resolution, access, correction, erasure and grievance, blockers, evidence, completion notice. W1.
Consent evidence view
Privacy notices and consent records per person. W1.
Audit export with integrity manifest
CSV or JSON export with a hash of the export. W2.
Legal hold registry
Holds by party, object, workspace or date range that block retention and deletion. W2.
Incident workflow
Severity, containment, notification clocks, post-mortem and evidence pack. W2.
Evidence packs
Pre-built bundles for access reviews, change logs, support sessions and deletion certificates. W2.
Audit Q&A
Natural-language questions with citations to event ids; read-only and permission-filtered. W2.
Archive and restore
Archive to object storage after 13 months hot; restore to a temporary schema. W2.
SIEM streaming and trust centre
Syslog, HTTPS or webhook streaming; a trust centre page per tenant or partner. W3.
Workflow
Answer an auditor's question
- 1
Auditor with a read-only audit role opens Audit Q&A.
- 2
Asks who approved refunds above a threshold last quarter.
- 3
The answer cites audit event ids.
- 4
Auditor exports the matching events with an integrity manifest.
Workflow
Handle a security incident
- 1
Incident is logged with severity.
- 2
Containment steps are recorded.
- 3
Notification clocks start for regulator and customers.
- 4
AI drafts notices for human approval.
- 5
Post-mortem and evidence pack are completed.
AI
AI skills and Digital Employees
Audit Q&A
Answers questions over the audit trail with event citations, or says there is no evidence.
DPDP request assistant
Drafts party resolution, data location reports and erasure plans with blockers.
Incident notification drafts
Drafts regulator and customer notices that a human approves before sending.
Digital Employees that use this module
- AI Privacy (DPDP) Operations Assistant
- AI Compliance Monitor
- AI Agent Governance Auditor
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
What does hash-chained mean?
Each audit event includes the hash of the previous one, so altering or deleting an event breaks the chain. A verification job checks this and alerts on any break.
Does One3 make me DPDP compliant?
No software does that alone. Trust & Audit provides workflows and evidence for data-principal requests, consent and incidents. Obligations are pointers to verify with counsel.
Can I stream audit events to my SIEM?
SIEM streaming over syslog, HTTPS or webhook is planned for Wave 3 on enterprise plans.
See Trust & Audit in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.