EXA36
— Send data to a third party —
Audit Log Access by External Auditors
External auditors demand 12 months of log access — Polymonial wraps the feed so they verify controls without reading your activity.
The problem to solve
External auditors (SOC2, ISO, PCI, regulator-appointed) periodically demand audit-log access. You ship log-platform exports / CSV dumps covering 12 months. The auditor sees every login, every action, every change — including those involving PII, customer activity, internal investigations. Audit fatigue at scale; auditor breach risk is your audit fatigue's biggest hidden tail.
The solution it enables
Audit log feed sealed at write time. Auditor's schema sets the rules (such as MFA enforced on each admin action); the answers come back as proofs over the sealed feed. Auditor verifies compliance evidence; PII + investigation details + customer activity stay sealed unless the schema explicitly grants the field.
What it looks like
A regulated payment platform has annual SOC2 + PCI + FCA audits. Each audit demands ~12 months of admin-action logs + ~24 months of customer-facing logs. Today: full log exports go to each auditor; the audit firm's analyst team sees everything. After Polymonial: the audit feed is wrapped. Each auditor's schema verifies its specific control evidence (MFA coverage, change-management approval rate, breach-detection time). PII and customer-activity detail stays sealed. The auditor verifies controls work; they don't read 12 months of the platform's activity.
“The auditor verifies the controls work. They don't read 12 months of your activity.”
Who’s this for you?
We have this problem.
Your organisation needs this for its own data, product or programme of work.
We deliver this for clients.
A consultancy, integrator, service provider, industry programme or technology vendor.