The question is never "what does it say now"
It is "what did it say in March, and who changed it". Klok records every model write across the platform through one global listener, so coverage does not depend on somebody remembering to add logging to a new screen.
One Listener, Whole Platform
Auditing is wired at the framework level rather than per feature. A module added later is covered by default instead of quietly missing.
Exports Are Events
Downloading personal data is itself recorded. Under most data-protection regimes, who took a copy matters as much as who edited a field.
Reversal, Not Deletion
Transactions are reversed rather than deleted, so the history stays intact and the correction is visible as a correction.
Sealed Periods
Once a payroll month is approved, the attendance behind it is sealed. Numbers that have been paid cannot quietly change afterwards.
Recording writes centrally, not per module
Audit trails usually rot in the same way: they are added module by module, so coverage depends on whether the developer of each screen remembered. Two years later nobody can say which screens are covered without reading the code.
Klok records model writes through one global listener. A new module is covered because it exists, not because somebody remembered to instrument it — which is the only version of an audit trail that stays true as a product grows.
Reading is an event too
Who changed the salary is the obvious question. Who exported the salary register is often the more important one, and it is the question most systems cannot answer at all.
Exports of personal data are recorded as events in their own right: what was exported, by whom, when, and covering which people. In a data-protection conversation that record is the difference between describing your controls and demonstrating them.
Reversal, not deletion
Transactions are reversed rather than deleted, and periods seal once approved. A correction after payroll approval therefore appears as a correction — visible, attributable, dated — instead of as a number that has quietly always been that way.
What the trail captures
Every write
Create, update and delete across the platform, captured by one listener rather than per screen.
Every export
Personal-data exports recorded as events: who, when, and covering whom.
Reversals
Corrections appear as corrections. A reversed transaction stays visible alongside its reversal.
Sealed periods
Once payroll is approved the period locks, and later changes are recorded against it rather than inside it.
Audit Trail FAQs
Can an administrator edit or delete trail entries?
No — and not us either, in the ordinary course. The trail is append-only by design: no screen, role or setting alters or removes an entry, including for the most senior administrator you have. This is the property that separates evidence from comfort. A trail that someone sufficiently senior can rewrite is worse than none at all, because it convinces an auditor without proving anything.
How long is history kept?
For the life of your account, and it leaves with you in your export when you go. Indian statutory records routinely need producing years after the event — a PF inspection asks about periods nobody currently employed remembers — so history that expires on a convenience cycle is history you will one day need and not have. We do not expire it.
Does it record reads and exports, or only changes?
Both changes and exports — who altered a record, and who took a copy of payroll or personal data, each with when and by whom. For an HR system the export question matters as much as the edit question: salary data that quietly left in a spreadsheet is the breach nobody can reconstruct later. Here it is a line in the trail, and exporting the trail itself is also recorded.
What does the trail actually capture on a change?
The record touched, what changed, who did it and when — written at the moment of the action, not reconstructed afterwards from logs. AI-drafted entries additionally record who confirmed them, which is what keeps responsibility with a person even when a machine did the typing. When an employee disputes a deduction, the answer is a register entry and a name, not a shrug.
Can we take the trail into an inspection or dispute?
Yes — export it like any register, with the export recorded. In practice this is where it pays for itself: a labour dispute or PF inspection turns on being able to show what the record said at the time and who changed it since, and an append-only trail answers in minutes what a spreadsheet-based office reconstructs over days, unconvincingly.
Is this billed as a module?
No — the trail is structural, not optional, because the guarantees on the security page depend on it existing for every tenant. Modules you switch off are not billed, but the trail is not a module: it is the thing that makes the rest of the system's claims checkable, and a version of Klok without it would be a different, worse product.
See it on your own data
Fourteen days, no card. Load a handful of employees and judge it against how you work today.