Your Rails audit log has 4 blind spots. Auditors know all of them.

paper_trail, audited and logidze answer “what changed, and who changed it?” well. HIPAA and SOC 2 reviews also ask who viewed or exported sensitive data, whether the log itself can be trusted , how long it’s kept , and whether you can produce evidence . This article walks through each gap with plain Rails and PostgreSQL code (read logging, a hash chain, an append-only table, a retention job) and compares the existing gems. It also introduces sealed_trail , a new MIT-licensed audit gem, though...