Policy
How we make changes traceable
What we record, how the record cannot be quietly changed, and how long we keep it.
Last updated · 28 May 2026
Every meaningful change on this site — a profile edit, a consent toggle, an eligibility evaluation, a staff action on your account — writes a row to an audit log. The log is structured so that nobody, including us, can change a row after it has been written without leaving a visible break in the record.
How the integrity guarantee works
Three layers, each independently useful, and combined deliberately so that defeating one is not enough.
The first layer sits in the database. Trigger functions reject any attempt to update or delete a row in the audit table at the database level. These triggers fire before the change can be written; bypassing them requires destructive database-administration rights, which themselves are logged and alerted on.
The second layer is a cryptographic chain. Every audit row carries a hash that covers its own contents plus the hash of the previous row. Editing a row in place breaks the chain at that row and at every row that follows it. A daily verification job walks the chain end to end and raises an alert on the first break.
The third layer is an immutable mirror. Every five minutes a background job copies new audit rows to write-once-read-many (WORM) object storage in India with Compliance-mode lock and seven-year retention. Once written there, the records cannot be deleted or altered by anyone — not by us, not by the cloud provider — until the retention period ends. The mirror has its own Merkle-root checkpoint that can be cross-checked against the database chain at any time.
Why this matters to you
If you ever exercise a right under the Digital Personal Data Protection Act, 2023 — the right to know how we used your data, the right to correct it, the right to have it erased, the right to file a grievance — the audit log is the evidence trail. It tells you, and a regulator if they ask, what happened to your record and who handled it.
If an insider with broad access ever tried to quietly erase the fact that they read or changed your data, the chain would break and the mirror would still show the original. The system is designed so an undetected cover-up requires breaking three independent things at the same time.
What is kept and for how long
Audit rows are kept for seven years in line with our consent-artefact retention. The WORM mirror inherits the same period and is the authoritative copy.
See also
This summary is reviewed quarterly. Last reviewed: 28 May 2026.