Keep an immutable settlement audit trail
SOC2 asks who changed the money and for proof nobody rewrote history. An append-only audit_log, a BEFORE UPDATE/DELETE guard trigger, and REVOKE make the settlement ledger tamper-evident: every mutation is recorded and edits to the log itself are rejected.
Problem
What you're actually looking at
The symptom as it shows up on a real server.
A financial system of record needs a write-once audit trail: an auditor must be able to see who changed a settlement and to trust that the trail was not altered afterward. A plain log table anyone can UPDATE or DELETE is not evidence, it is a suggestion. Immutability has to be enforced by the database, not by policy.
Meridian Freight must show a SOC2 auditor the full change history of the settlement ledger and prove the history is tamper-evident. The lab installs an append-only audit_log fed by an AFTER trigger on settlement, and a BEFORE UPDATE/DELETE trigger on audit_log that rejects any attempt to rewrite it, then shows both the recorded rows and the rejected edit.
Simple terms
Keep a separate audit_log table. A trigger writes one row to it for every insert/update/delete on the settlement ledger, capturing who, what, and when. A second trigger blocks any UPDATE or DELETE against audit_log, and you REVOKE those rights from the app role too. History goes in; nothing comes out. That is what makes it evidence.
Full runbook for this incident
- The full identify checklist, the exact signals that tell you it's this incident
- Every diagnostic query; lab output is attached only to the steps we actually captured
- The resolution path and the pitfalls that make it worse
- Mitigation steps to stop it recurring, plus a verify-you're-done query
Card required. Cancel before day 7 and you are not charged.
Related runbooks
Continue the same incident path
Sibling procedures that cover the adjacent setup, recovery, or prevention step.
More in this category
Other Mission-critical platform runbooks
Neighbouring incidents that share the same diagnostic surface.
Connected
How this connects to the rest of the library
A live view of this page's real cross-references, what explains it, what fixes it, what to tune, and where to go next. Every link is an authored relationship, not a guess.
Fixes these errors
Need the full procedure?
Pro runbooks finish the incident path
Free runbooks teach the shape. Pro opens the full step transcript, edge cases, and prevention depth.