# Append-only records

URL: /systems/trust-and-governance/controls/append-only-records · Id: `control:append-only-records`

> No writer holds update or delete privilege on the Event log, so every Event is kept forever.

No writer holds update or delete privilege on the [Event](/business/nouns/event) log, so every Event is kept forever.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC7.2](/systems/trust-and-governance/criteria/soc2/cc7-2) | The entity monitors system components for anomalies that indicate malicious acts, natural disasters or errors. |
| [SOC2 PI1.5](/systems/trust-and-governance/criteria/soc2/pi1-5) | The entity stores inputs, items in processing and outputs completely, accurately and on time. |
| [ISO27001 A.5.33](/systems/trust-and-governance/criteria/iso27001/a-5-33) | Records are protected from loss, destruction, falsification, unauthorized access and unauthorized release. |
| [HIPAA 164.312(c)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-c-1) | Electronic protected health information is protected from improper alteration or destruction. |

## Implemented by
- [Security](/workflows/processes/security)
- [Verification](/code/verification)
- [Audit log](/systems/trust-and-governance/audit-log)
- [Event streams](/code/platform/event-streams)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every grant on the Event log, and every write attempt the control tester makes. |
| Assert | No grant includes update or delete, zero bypass Events exist, and at least one tester attempt per period ends `refused`. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A tester asks to delete last week's `Invoice.paid` Events for a dental-reminder [SaaS](/products/templates/saas). No grant allows it, so the request ends `refused`, and the refusal is itself a new Event in the log.