Mersal Immutable Audit Trail
The problem
Most systems have an activity log. Very few have one that survives the person with the highest privileges deciding it should say something else. When a fee, a deadline or an instruction is disputed, a log that an administrator could have edited is evidence of nothing.
How Mersal solves it
Mersal's ledger is append-only at the database, not in the application. Database triggers reject UPDATE and DELETE on audit records for every role, including administrators and the service role the application itself runs as. There is no screen, no script and no support procedure that edits a past entry, because the database refuses it.
How it works
Enforced where it cannot be argued with
The guarantee lives in the database, not in code that could be bypassed by a different code path. A trigger raises on any attempt to modify or delete an audit row, whoever is asking. The application holds no privilege that lifts it.
Written as the work happens
Entries are produced by the work itself — a matter opened, a conflict cleared, an invoice issued, a payment recorded, access granted — so there is nothing to reconstruct later from memory.
Failures are captured, not swallowed
If an audit write fails, the event is captured rather than lost, and a nightly reconciliation replays it. A ledger that quietly drops entries under load is not a ledger, so the failure path is treated as carefully as the success path.
What it prevents
- A privileged user quietly amending history
- "The system must have lost it" as an explanation
- Reconstructing a timeline from memory months later
The fastest way to judge this is to watch it run against your own way of working.