Immutable WORM Audit Trails & Non-Repudiation

Aarkam incorporates continuous, tamper-evident audit logging designed to satisfy NCA ECC-2:2024 §2-12, NCA DCC-1:2022, and SOC 2 Type II non-repudiation mandates.

1. Dual Audit Schema

The platform maintains two synchronized audit repositories:

1. FullAuditingLog — Platform & Administrative Actions

Records all configuration mutations, IAM authentication events, bucket policy modifications, and key rotation executions:

• Timestamp: Microsecond-resolution UTC timestamp (TimestampUtc)
• Actor: User identity, tenant ID, and source IP address
• Action: Operation type (CreateBucket, RotateKey, DrainNode, ShredObject)
• Parameters: Sanitized JSON payload capturing before/after state diffs
• Security Checksum: HMAC-SHA256 signature calculated across the record row to detect manual database tampering

2. FileAccessLog — S3 Object Data Plane Auditing

Tracks read, write, delete, and copy requests across every stored object:

• Client IP, TLS cipher suite, S3 bucket, object key, byte length, and latency.

2. Retention Governance & 12-Month Mandatory Lock

In strict alignment with NCA ECC 2-12 and SDAIA PDPL:

• Mandatory 12-Month Retention: Audit records are locked against deletion or modification for a minimum of 12 months (365 days).
• WORM Immutability: Database-level triggers and table permissions prohibit UPDATE or DELETE operations on audit tables. Only sequential INSERT operations are permitted.
• Automated Partition Purge: Records older than the regulatory retention period are archived to write-once cold media before automated partition truncation.

3. Real-Time SIEM Integration

Aarkam streams audit events in real time to centralized Security Information and Event Management (SIEM) systems using standard protocols:

• Syslog over TLS (RFC 5425): Direct streaming to Splunk, IBM QRadar, Wazuh, and Microsoft Sentinel.
• Common Event Format (CEF) & JSON: Structured logs formatted for automated correlation rules and threat hunting.