When someone says “we need an audit trail,” they rarely mean a wall of JSON. They mean defensible evidence: who touched a sensitive document, when, and under what authority—without inventing a story after the fact.
This guide covers what auditors and customers actually ask for, how document vaults differ from Drive admin logs, and how to talk about insert-only activity honestly.
What “good” looks like in a document access trail
- Stable object identity (even if the display name changes)
- Actor identity (user, share recipient, or system)
- Action type: upload, view, share, delete, move, purge
- Timestamp in a clear timezone or UTC
- Exportable format for the questionnaire packet
Nice-to-haves include IP/network metadata (often hashed), previous-hash chaining for tamper evidence, and legal hold flags that block deletion.
Questions that show up in real reviews
- Can you show who downloaded the diligence folder last quarter?
- Can employees permanently erase evidence of access?
- Do shared links create auditable events?
- Is logging independent of the document plaintext?
- How long are records retained?
- Who can export or alter the activity stream?
Notice what is missing: “Paste the PDF into the ticket.” Auditors want control evidence. Content review is a separate workflow.
Drive admin logs vs vault activity
Collaboration platforms provide rich admin audit streams—excellent for IT. A zero-knowledge vault optimizes for a narrower story: sealed objects, explicit share events, and activity that does not require the operator to read file contents.
Compliance Locker records insert-only vault activity for events such as uploads, views, shares, and deletes at the application API layer. That is useful evidence—and it is not a marketing substitute for SOC 2 or a sealed WORM system. We document the distinction on Compliance and Trust.
| Need | Drive / Workspace logs | Sealed vault activity |
|---|---|---|
| Broad IT investigation | Strong | Narrower scope |
| Proof of sealed packet access | Possible via ACLs | Designed for this |
| Operator cannot read content | Not the model | Core design goal |
How to prepare a packet before anyone asks
1. Classify what belongs in the vault
Not every spreadsheet needs a sealed vault. Put board packs, signed MSAs, incident reports, and regulated attachments where access evidence matters.
2. Standardize share policy
Default expiry, avoid eternal links, and document who may mint shares. See sharing without shared passwords.
3. Rehearse export
Know how to export activity before audit week. A control you cannot retrieve under time pressure is a control you do not have.
4. Write honest questionnaire answers
Say “insert-only application activity” if that is what you have. Do not claim immutable WORM or third-party attestation unless you operate those systems.
Sample narrative for security questionnaires
A defensible short answer often looks like: documents are encrypted client-side before upload; vault activity records upload, view, share, and delete events as insert-only API records; exports are available to authorized operators; the log is not a sealed WORM ledger. Point reviewers to your Trust Center and security docs rather than inventing certifications.
FAQ
Is an insert-only audit log the same as a WORM ledger?
No. Application insert-only activity is a useful control, but it is not the same as a sealed WORM archive or third-party attestation. Be precise in questionnaires.
Do auditors need plaintext documents in the log?
Usually no. They need evidence of who accessed which object and when—not a copy of the file contents in the log stream.
Are Drive admin logs enough?
They are valuable for IT investigations. They answer different questions than a vault designed around sealed packets and client-held keys.
How long should we retain access activity?
Match retention to your contracts and regulatory posture—often aligned with the document class’s retention schedule, not an arbitrary ‘forever’ dump.
What if an employee deletes a file?
A useful trail still records the delete event and actor. Whether legal hold can block purge is a product and process question—document both.
Related: Compliance capabilities & disclaimers, client-side vs server-side encryption.