Story: the audit trail
This page is for journalists who cover accountability, compliance work and security operations. Exponential records who did what in a log that can prove it was not edited afterwards. This page gives the story, the facts with sources, and the wording to avoid.
Contents
- The story in one paragraph
- What is new, and when
- Facts you can print
- What not to claim
- Explaining it to readers
- Angles and headline ideas
- Who to ask
- Related pages
The story in one paragraph
"Exponential 6.0.15 records security-relevant events in a tamper-evident log: sign-ins and refusals, content changes,
settings writes, cache clears, deploys, orders and VAT changes. The log is on by default, needs no setup, and can be
read from the admin interface or the command line" (The audit trail). "Every
record carries the hash of the record before it (a hash chain)", and a verify command tells whether anything was
edited or cut. The trail is also careful about the people it records: addresses are truncated and passwords are never
written down. (The feature belongs to the 6.0.15 line and was added on 2 October 2026; that is the date of the change, not a
release date.)
What is new, and when
| What | When | Source |
|---|---|---|
The audit trail: hash-chained, signed, searchable, with the exp:audit command, the Audit tab, sinks, alert rules and archives; on by default | 2 October 2026 | 6.0.15 changelog |
| Extension sources in the audit console, streamed and background exports | 12 October 2026 | 6.0.15 changelog |
| A timeline for admin4's audit events | 14 October 2026 | 6.0.15 changelog |
| Exponential Intelligence logs its requests as audit events | 12 October 2026 | expai, For administrators |
Facts you can print
| Fact | Source |
|---|---|
| It is on by default and needs no setup. | The audit trail |
| Every record carries the hash of the one before; daily files are closed, archived and listed in signed manifests. | The audit trail, Why you want it |
| Alert rules watch for brute-force sign-ins, an administrator role being granted, settings written out of hours, mass deletes, the audit being switched off and a broken chain. | same |
| Addresses are truncated, sessions hashed, user agents shortened, query values removed. | same |
| Passwords, tokens, repair keys and secrets are never recorded. | same |
| A subtree removal is one parent event with one child per node below it. | same |
| Sinks include syslog, journald, a signed webhook and mail; archives in five formats. | 6.0.15 changelog |
| Exponential Intelligence requests are audit events, but never a prompt, an answer or a key. | README, Safety |
What not to claim
- "The audit trail makes a site compliant" with any regulation. It is evidence an organization can use; compliance depends on the organization.
- "Nobody can change the log." The source says changes can be detected (
verifyexits 1 when a chain is broken). - "It records everything users do." It records the events listed in its catalog; read the audit guide before saying more.
Explaining it to readers
Every entry in the log contains a fingerprint of the entry before it. Change or delete one old entry and the
fingerprints no longer match, so a check finds the gap. The log does not stop someone with access to the server
from editing it - it makes the edit visible.Angles and headline ideas
"Who removed this page? An open source CMS that can answer - and prove it"
"A log with fingerprints: Exponential's tamper-evident audit trail"
"Recording the actions, not the people: privacy rules inside an audit log"Who to ask
| Question | Ask | Where |
|---|---|---|
| Design and use cases | 7x | [email protected], or https://exponential.earth/about/contact-us |
| How administrators use it | the community | https://share.exponential.earth/forums |
Related pages
- Story: security
- The audit trail (feature page)
- Story: an assistant that writes drafts only
- Feature stories: index
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.