Audit-Trail Standard

What We Record

For each lead or batch, where feasible: an immutable lead or batch identifier; the source name, type and lawful-access basis; the source record or instrument identifier; the jurisdiction; the collection date and time; the source update date; the fields collected; the transformations, matches, enrichments and confidence applied; the vendor and contract version; the quality checks performed; suppression status and time; the product or category; the delivery customer, user, time and method; and any later correction, recall or deletion.

For each customer: the verified legal entity and its users; licences and states; declared purposes and channels; agreement and certification versions; the acceptance timestamp, IP address and document hash; orders; access and export events; approved vendors; risk tier; reviews; complaints; investigations; sanctions; and deletion attestations.

What You Must Be Able to Produce

For any campaign, on reasonable request: the campaign and seller identity; the lead identifiers used; the jurisdiction logic applied; the channel and the technology; the registry subscription and the scrub source, date, version and result; the internal suppression result; the consent artefact wherever consent was relied on; the scripts or templates and their versions; the caller ID or sending domain; send and contact timestamps with time zones; dispositions; opt-outs and revocations; complaints; the vendor or operator involved; and the corrective action taken.

The platform's activity log, contact history and audit trail help you assemble this, but the campaign record is yours to keep.

Integrity and Access

Logs use synchronized time and, where proportionate, immutable or tamper-evident storage. Access is role-based, logs are encrypted, exports are controlled, corrections are documented and access is monitored. An audit event is never silently overwritten. Logs hold only the data they need — a reference or a hash is stored instead of a full sensitive document wherever that is enough.

Review Cadence

Suppression and anomaly checks run continuously or per batch. Operational quality review is monthly. High-risk customer and campaign review is quarterly. Vendor and security review is annual. An event-driven review follows any complaint, change in the law, source change or incident. Owners, findings, deadlines and closure evidence are tracked.