What is an audit trail?

Immutability is what distinguishes it. Entries are added and never edited, which is what makes the record worth anything as evidence.

Coverage has to be complete for the trail to mean much. Gaps invite exactly the question the trail was built to answer.

Deletions are the entries that matter most and the ones most often missing. A record that vanished without a trace is the worst case.

Regulated industries require them by name, which is why the feature usually appears in enterprise tiers rather than entry ones.

Say a patient arrives at your clinic at 2:00 on Friday and the calendar has no record of her. She has a confirmation text. Your front desk says nobody touched it. With a plain activity log, you might see that the appointment was "updated" on Wednesday and nothing else.

A real audit trail gives you the sequence. On Monday at 10:02 the booking was created, with the slot and her number. Two days later, at 16:47 on Wednesday, it was deleted by the user account "jamie", from the office computer. One minute later, a new booking was created in the same slot for a different patient. Each entry carries the before and after values, and nobody can edit them, including Jamie and including you. Now you know it was a mistaken overwrite on a busy afternoon, and you can apologize with the facts in hand.

People confuse the two because both are lists of events with names and times. An access log mostly answers who looked. Your audit trail answers who changed what, from which value to which value, and it's built so nobody can rewrite it afterward. Ordinary logs sit in a table an administrator could edit. Audit-grade ones are append-only, and they're often chained so that altering one entry breaks every entry after it.

Put four questions to a vendor. Can an admin delete or edit entries? Are deletions recorded with the deleted content, or only the fact of deletion? How long are entries kept? Can you export them without the vendor's help?

If you're a five-person shop with no regulator, a trail is nice to have. Once an auditor, an insurer or a court might ask you to prove what happened, it's the record they'll accept over anybody's memory.

GreetKeeper carries no certifications and makes no compliance attestation, so we are not going to describe our logging as an audit control.

Call records themselves are the thing most people want a history of, and retention is the setting that governs them.

Where a formal audit trail is a hard requirement for your industry, that is a genuine reason to look at an established vendor.