Ottili ONE is built so that important actions are never invisible. Every state-changing action is recorded, and the records are designed to be tamper-evident.
What gets audited
State-changing actions across Ottili ONE are written to append-only audit logs. This includes security-relevant and administrative actions such as API-key generation, revocation and rotation, settings changes, partner actions, and failed authentications.
Append-only audit writes exist across multiple Ottili ONE services — content automation, the simulation engine, and the approval audit log — so activity is observable wherever it happens.
Tamper-evident by design
Audit records are designed to be tamper-evident: they are written append-only, with no in-place modification or deletion. We qualify this carefully — it is enforced at the service level (for example, in the content automation and simulation engine audit tables) rather than as a single global guarantee across the entire platform. We surface the honest guarantee rather than overstate it.
Accountability and your team
Audit logging is integrated with the approval workflow. When an action moves through an approval queue, the approval-lifecycle steps are recorded in the approval audit log, so a sensitive operation is always traceable to who requested it, who approved it, and when.
Cross-company access is tracked in the audit log. Because Ottili ONE is company-scoped, the audit trail makes shared-data boundaries observable — you can see when activity crosses a company context.
Roles and visibility
Who can read audit data follows the same explicit-permission model as everything else in Ottili ONE. Only the roles you grant appropriate access to can view company audit information; sensitive audit views are not available to read-only roles by default.
For the permission model that governs audit visibility, see [Roles and permissions](/docs/roles-and-permissions). For the team and company setup, see [Company and team](/docs/company-and-team).
Was this article helpful?