SHA-256 Audit Chain, Legal Hold & Break-Glass
Tamper-evident hash-chained audit logs, CSV formula-injection protection, legal hold preservation, and dual-control Break-Glass inspection.
Cryptographic Audit Integrity
Every administrative and governance event is appended to audit_log with prev_hash_hex and row_hash_hex = SHA256(prev_hash_hex | id | workspace_id | actor | action | target | metadata | created_at). Compliance officers can verify the entire chain at any time via GET /api/v1/admin/audit-log/verify or madarctl doctor.
Active Legal Holds (/api/v1/admin/legal-holds) prevent retention purge jobs from deleting covered user or channel records until the hold is explicitly released.