Docs

Audit Storage

Audit storage in AUDITZ is responsible for securely persisting all audit events in a durable, structured, and tamper-resistant way.

It ensures that once an event is received, it is stored in a format that guarantees integrity, traceability, and long-term availability.

What is audit storage?

Audit storage is the central persistence layer where all audit events collected by AUDITZ are written and maintained.

It is designed to:

  • Store audit events in an append-only structure
  • Preserve the exact order of events
  • Ensure data integrity over time
  • Provide efficient query and retrieval capabilities
  • Support long-term retention and compliance requirements

Append-only model

AUDITZ uses an append-only storage model for audit data.

This means:

  • Events are never updated or overwritten
  • New events are always added at the end of the log
  • Historical data remains fully intact and traceable

This model is essential for ensuring audit trustworthiness and preventing tampering.

Integrity & tamper resistance

Audit storage is built with strong integrity guarantees.

It includes mechanisms to ensure:

  • Detection of any unauthorized modifications
  • Cryptographic or structural validation of stored events
  • Consistency checks across stored sequences
  • Protection against partial or corrupted writes

This ensures that audit data remains a reliable source of truth.

Data organization

Audit events are organized in a structured way to support scalability and performance.

Common structures include:

  • Topic-based partitions for incoming event streams
  • Domain separation for different audit categories
  • Time-based segmentation for efficient querying and retention
  • Indexed metadata for fast lookups and filtering

This allows AUDITZ to scale while maintaining performance and consistency.

Retention & lifecycle

Audit storage supports configurable retention policies.

These define:

  • How long audit data is stored
  • When data is archived or compacted
  • Compliance-driven retention requirements
  • Storage optimization strategies over time

Even after long periods, audit data remains verifiable or recoverable depending on policy configuration.

Security of stored data

All stored audit data is protected using layered security measures:

  • Encryption at rest
  • Controlled access to storage layers
  • Strict separation between ingestion and query systems
  • Auditability of storage access itself

This ensures that even the storage layer remains accountable and secure.

Query performance

Audit storage is optimized for read-heavy workloads such as:

  • Compliance queries
  • Incident investigations
  • Timeline reconstruction
  • Cross-service event correlation

Efficient indexing and partitioning ensure that even large-scale audit datasets remain searchable.

Part of AUDITZ architecture

Audit storage is the foundation of the AUDITZ system.

It connects directly to:

  • Event ingestion pipelines
  • Audit trail reconstruction
  • Audit management policies
  • External audit and reporting tools

Together, these components ensure a complete and reliable audit system.

Where to start

To work with audit storage in AUDITZ:

  • Configure event ingestion topics
  • Define storage partitions and retention policies
  • Enable indexing for required query patterns
  • Verify integrity and access controls

From there, AUDITZ ensures all audit data is stored securely and remains fully traceable over time.