This guide shows how to build and operate your own WORM storage and hash-chain verification.
The examples are customer implementations, not features shipped in @vendure-platform/audit-governance.
The package ships retention and export strategies. It does not ship a hash chain or WORM storage.
The Audit Trail plugin provides application-level immutability out of the box: there are no APIs
to modify or delete audit log entries, and the plugin only ever appends new entries via the sink's
write() method. However, anyone with direct database access could still alter or remove records.
For organisations that require true tamper-proof audit trails (for compliance with regulations like SOX, HIPAA, or PCI-DSS), the plugin's strategy pattern allows you to integrate with storage backends that enforce immutability at the infrastructure level.
Sign in with your Vendure Console account to read this documentation.