Every request,
on the record.
Astry writes an append-only journal of every query, every file the model could see and every answer it returned. The database itself refuses edits and deletes, and logging never blocks a request.
Audit log.
Every API call + admin mutation, month-partitioned. Cursor-paginated ; CSV export honours the current filter set.
9f3a1c7eask.successspace:revenue-ops · 6 files2d8b4f01mcp.askspace:eng-platform · 9 files7c1e9a44ingest.dlp_quarantinedrive/contracts/NDA-Atlas.pdf7c1e9a44ingest.successslack/#finance · 23 messages9f3a1c7eadmin.dlp_rule.deletedlp_rule:iban-fr@rev142d8b4f01ask.rate_limitspace:eng-platformingest.successsharepoint/Legal · 41 files7c1e9a44ask.successspace:revenue-ops · 4 files9f3a1c7eadmin.user.updateuser:s.reed@astry.agency2d8b4f01mcp.askspace:eng-platform · 12 filesAppend-only · query, files touched, latency, cost
A record that holds up.
Each entry captures the query, the files the model could see, the action, its latency and its cost. Nothing is edited after the fact, and writing it never slows the answer down.
Append-only at the database
Every file the model could see
Never blocks a request
Anomaly detection
Dual-written and exportable
Erasure that records itself
Answer an audit in three moves.
When a regulator or a security team asks who saw what, you do not reconstruct it. You filter, you trace, you export.
- 01
Filter
Narrow the journal by user, time window or source. Find the exact requests in question without scrolling endless rows.
- 02
Trace
Open a request to see every file the model could see for that answer. The projected set is recorded, not inferred.
- 03
Export
Export exactly those requests as CSV. Because the journal is append-only, the export is the record, not a copy someone could have edited.
The audit layer, in detail.
- Record
- Query, files the model could see, action, latency and cost.
- Storage
- Dual-written to JSONL and Postgres, workspace-scoped.
- Mutability
- Database role has INSERT and SELECT only; UPDATE and DELETE revoked.
- Blocking
- Logging never blocks a request.
- Anomaly detection
- Built-in; flags access that breaks the normal pattern.
- Erasure
- GDPR Art. 17 and DSAR tooling; the deletion is itself recorded.
Good to know.
No. The application's database role can only insert and read entries; update and delete are revoked at the database itself. A past entry cannot be edited or removed, including by us, and each entry is also written to a JSONL stream you keep.
Answer the next audit from the record.
Filter the journal, trace a request, export exactly what was asked. The evidence is already written, and the database will not let anyone edit it.