A record nobody can quietly rewrite.

Who, what, before and after

Every row added, changed or deleted is logged by the database itself, in the same transaction as the change, with the person who made it. Code cannot skip it.

Actions in plain words

A second log keeps what people did: spec updated, role changed, disposition recorded, signed in.

Changes from outside the app stand out

A change made straight in the database is labelled Outside the app, so it can never pass as someone’s work.

Append only

The database refuses any edit or delete of a log entry, and the app’s own login is not allowed to try.

Sealed every 15 minutes

New entries are sealed into a SHA-256 hash chain, and the chain is checked each time. Changing an old entry breaks every link after it.

Copies kept apart

Each sealed batch is copied to separate storage that is locked against changes for as long as you choose, seven years for example. Someone who rewrote the database would still not match the copies.

The last check, on screen

Admins see both logs and the result of the last tamper check under Setup, Audit log, in the web app and on the iPad.

Signed means final

An authorised checklist run, an approved batch order and a closed CAPA cannot be edited by anyone.

Numbered revisions

Checklist templates, tests, product specs, formulas and report templates get numbered revisions, and every change after the first says why.

Readings keep their revision

Runs, readings and batch lines record the revision they were made against, so a report reads the spec as it stood that day.

Compare any two versions

Both apps show the history of a document and compare two versions field by field.

When someone leaves, their personal information can be erased while the quality records they signed stay, as Québec’s Law 25 allows. The change log never keeps names or email addresses in the clear.