AI Audit Trail: Auditable AI You Can Verify Without Trusting the Vendor

Every enterprise AI vendor says they log everything. It is true, and on its own it is nearly worthless — because a log you have to take on faith is not evidence. It is the vendor's account of what happened, which is exactly what an audit exists to check. The word that matters is not logged. It is auditable: can someone outside your team, and outside ours, confirm what a system did without having to trust the party that did it?

That distinction sounds pedantic until the day it is not — a regulator's request, a dispute over what an agent changed, a security review that will not accept "trust us". The difference between a platform that logs everything and a platform with an auditable AI audit trail is the difference between a story and a receipt.

What turns a log into an AI audit trail?

A log becomes evidence when three things are true of it: it captures the events that matter, it cannot be quietly altered after the fact, and someone who does not trust the author can still verify it. Most systems clear the first bar and stop.

SphereIQ writes administrative and security events — who signed in, who changed a policy, who approved an agent's action, what a run did — to an audit log, and each write is confirmed before the request completes, so an event is never lost to a process that finished early. That is table stakes. What makes the record auditable is what happens next, and it rests on two ideas: a signed record you can recompute, and an export the other side can check.

How does a signed receipt work?

When SphereIQ records something that must be provable later — the release of an agent, an applied promotion — it does not just store a row and assert the row is genuine. It signs a receipt.

The signature is Ed25519 over a canonical JSON serialization of the event — canonical meaning the keys are sorted and the encoding is fixed, so the same facts always produce the same bytes. The important part is what gets signed: the payload is rebuilt from the stored record at verification time, not kept as a separate copy that could drift from the record it claims to cover. To verify, you reconstruct the payload the same way and check the signature against the public key. If it matches, the record is exactly what was signed; if the record was edited afterwards, it will not.

There is a deliberate refusal built in. If signing fails, the record is marked unsigned — it never quietly reads as valid. An honest "this was not proven" is worth far more than a signature that might be decorative.

What makes an e-discovery export tamper-evident?

Discovery is the moment logging meets an adversary. When records have to be handed to a regulator, an auditor or opposing counsel, the recipient's first question is whether the export was altered.

SphereIQ's e-discovery export is tamper-evident by construction:

• Plain, streamable records. Records stream out as NDJSON — one JSON object per line — so an export of any size is a plain, searchable file rather than a proprietary bundle.
• A signed manifest. The export carries a manifest signed with the same receipt mechanism.
• A hash the recipient reproduces. The hash over the record stream can be recomputed from the file the recipient was given. If a single line was added, removed or altered, the hash will not match — and the recipient can see that without asking us.

Evidence you can only verify by asking the vendor to verify it for you is not evidence.

Where should AI audit logs live?

Auditability is about what can be checked; residency is about where the record lives and what it must never contain.

• In your SIEM. Security events forward to your own SIEM — as Splunk HEC, Datadog, CEF or plain JSON — so the durable copy lives in the system your security team already runs, under your retention rules.
• Behind your identity provider. Access runs through SAML single sign-on and SCIM provisioning, so a departure removes access on the next request; programmatic access uses tokens scoped to exactly what they were issued for.
• Without secrets. Secrets and keys are scrubbed from everything a run records, so an audit entry carries a secret's name and never its value. The log has to be safe to keep, or you cannot keep it long enough to be useful.

SphereIQ is SOC 2 Type II certified, and this audit trail is what makes your own reviews tractable: records that are captured, verifiable and yours, so an ISO 27001, ISO/IEC 42001 or EU AI Act assessment checks evidence it can reproduce rather than a claim it has to accept.

How to evaluate auditable AI

Do not ask whether a platform logs. Everything logs. Ask three narrower questions: can you hand me an export I can verify was not altered, without calling you? Can I recompute a signature over a record and check it against your public key myself? And do the logs land in my SIEM, or only in your console?

The same records answer the question every agent deployment eventually faces — what did it change? — covered in AI agent governance. And when the platform runs in your own cloud, the records never leave it: see self-hosted LLMs in your VPC.

Frequently asked questions