Our Auditor Asked How We Prove Logs Aren

We were 4 months into our SOC 2 audit when the auditor asked a question that stopped us cold: "How do you prove that your audit logs haven't been modified after the fact?" We looked at each other. Our audit logs were in a PostgreSQL table. Anyone with database access could UPDATE or DELETE rows. We had no mechanism to detect if someone had changed a log entry. "We trust our engineers" was not the answer the auditor was looking for. Why Immutability Matters The whole value of an audit log depends