Tamper-evident audit log

What it is

The Audit log records every important change in your workspace: who did it, what changed and when. Examples are hour approvals and rejections, recorded impact values, report and pack exports, AI drafts and perk redemptions.

Each entry is linked to the one before it with a SHA-256 hash. If anyone changed, removed or inserted a past entry, the chain would no longer match, and the Audit chain card would show where it breaks. On top of that, the database itself rejects edits to the log and rejects deletions except during account deletion or data-retention jobs.

This matters when your ESG figures are reviewed by an internal auditor, an external assurance provider or a board committee: you can show that the records behind the numbers have a traceable history.

What you can use it for

• Show an auditor who approved a set of volunteer hours and when.
• Check that nobody exported a report without your knowledge.
• Export the log as CSV and verify the chain offline.
• Keep the last hash in board minutes or an email to your auditor as an outside anchor.

How to do it

Check the chain

1. Open the logGo to CSR workspace → Audit log.
2. Read the Audit chain cardIntact means all entries were verified and none were changed, removed or inserted. Broken at #n means entry n or an earlier one was changed outside CorpHands; rows from that point are highlighted.
3. Re-checkChoose Verify now to run the check again. The card shows the time it was checked.
4. Note the last hashWhen the chain is intact, the card shows the Last hash. Record it somewhere outside CorpHands.

Filter and export

1. FilterUse Action starts with (for example hours. or report.), From and To, then choose Filter. Clear removes the filters.
2. Export CSVChoose Export CSV. The file uses the same filters and includes the sequence number, time, user, action, record, details, previous hash and hash. The export itself is logged.
3. Verify offline (optional)Your IT team or auditor can recompute the hashes from the CSV with a short script. CorpHands can share the method on request.

Tips and good practice

• The ESG report page also shows the chain status in its Verification summary, and the printable report repeats it. If it says Broken, contact support before using the figures externally.
• The CSV contains users' names and email addresses. Share it only with people who need it.
• Limitation: someone with full database control could in theory rewrite the whole chain from a point onwards. Keeping the last hash outside CorpHands lets you detect that.
• Auditors can read the log but cannot change anything in the workspace.

Questions