Use Case · Compliance

Audit log platform on the Software Lifecycle Cloud

An audit log platform on KERNSTACK makes “who changed this record, from what, to what, when” a table design: application functions write each change — actor id, before-image, after-image, timestamp — into an audit table keyed by record and time, table change streams can feed entries automatically, and retention is a declared property rather than a hope about log rotation.

NoSQL TablesFunctions (WASM)Product AnalyticsObject Buckets
Talk to us Read Technical Documentation → Software Lifecycle Cloud →

The engineering bottleneck with assembled stacks

Compliance officers ask where a record changed and receive application logs: unstructured, rotated, missing the actor, missing the before state. The truthful answer “we cannot reconstruct that” ends audits and occasionally companies. Retrofitting auditability later means touching every write path under time pressure, which is why it stays unretrofitted.

Architecture on the Software Lifecycle Cloud

The audit table is keyed by the audited record’s id with time as the sort key, so a record’s whole history is one ordered read. Write paths either emit entries explicitly — best for business meaning (“discount approved by”) — or lean on a table change stream that invokes a function with batched item changes. Retention windows and legal holds are fields the archiving worker respects.

Before-images are the difference between a log and evidence

An entry that says “record updated” is a rumour; an entry carrying the before and after values is evidence. Storing both costs storage at 0.04 credits per GB-hour and buys the only audit answers that matter: what the world looked like before this person acted, and after. Queries by actor run the other direction — everything this id touched this quarter — from the same rows.

  • One ordered read returns a record’s complete change history
  • Change streams can generate entries automatically for tables whose writes should never be silent
  • Holds and retention are enforced by the archiving job reading the same fields auditors query

What an audit log cannot fix

It records changes made through the system; it cannot see changes made around it. The discipline that makes it evidence-grade is boring: all writes flow through functions and workers that emit entries, and direct data surgery is treated as an incident. The platform gives the pattern a home; the team gives it completeness.

FAQ

Frequently asked questions

Both, for different tables. Business-critical writes deserve explicit entries with business language. High-volume tables can rely on a change stream invoking a function with batched before/after changes — automatic coverage with no per-call-site effort.

As long as your retention fields say — the archiving worker enforces per-table windows and legal holds, moving cold history to bucket files with checksums. Storage is 0.04 credits per GB-hour, so retention length is a visible, priced decision.

They can be given a read surface over exactly these tables: by record, by actor, by window. Because entries are structured rows with before/after images, auditor questions are queries, not engineering tickets.

Connected in the Project Graph

Related capabilities, architectures, and comparisons

Category PillarThe Software Lifecycle CloudWhy people and agents build, deploy, and operate on a single vertically integrated stack.Service · DataTablesServerless key-value and document tablesService · ComputeFunctionsGo WebAssembly HTTP handlersService · InsightAnalyticsProduct analytics on the same fabricService · DataBucketsObject storage with presigned uploadIndustry SolutionLogistics Cloud SolutionsLogistics products on KERNSTACK give every shipment one timeline and every exception an owner: carrier scans and status callbacks are stored raw, normalised into canonical states per shipment, reconciled against orders by workers, and surfaced — to dispatchers as an exception queue, to customers as a tracking page reading the very same rows. The fog between “the carrier says” and “our system says” is where this architecture earns its keep.Use Case · ProductExperiment assignmentAssignment is a pure function of the subject key and the experiment’s salt — stable across requests, no coordination needed. The function records the assignment row once and serves the variant; outcome handlers were already writing events, which now simply carry the experiment id the assignment returned. Analysis reads assignments and outcomes from neighbouring tables with the same keys.Use Case · AgenciesAgency client deliveryThe studio’s delivery shape is a template stack.json: gateway, functions or workers in the client’s stack languages, tables, buckets, and apps under one target per client, on European infrastructure the studio can name in the pitch. Previews run the same declaration; the client’s approval happens in the bound conversation with a live link. Every client’s meter is separate by construction — the studio sees delivery cost per client without allocation spreadsheets.

Ship your stack on the Software Lifecycle Cloud.

Closed preview on dedicated European infrastructure. Bring a repository or start from a blueprint.

Talk to us See pricing & credits →