Skip to main content

​
Audit Trail

Every significant action in ChangeGuard is recorded in an immutable audit trail. The application backend can append new entries but does not have the privilege to modify or delete existing ones — audit history is append-only at the database grant level, not just by application convention. Even an elevated session inside the backend cannot rewrite history. Recorded actions include:
  • Deployment gate decisions (SAFE, WARN, BLOCK)
  • Policy evaluations and scoring events
  • CI/CD validation requests and results
  • Suppression changes (muted/unmuted risks)
  • Configuration changes (notification channels, policies)
  • ArgoCD sync events and webhook activity
Each audit entry includes:

​
Audit Export

Export the full audit trail as CSV from Intelligence → Audit Trail → Export. The CSV includes all fields above, plus GitHub/GitLab context (PR number, approval status, CI pass/fail, branch, commit SHA) when available. Source IP is included in every row for incident correlation.
Use audit exports for compliance reviews, incident investigations, and change management reporting. The export covers your full history — there is no time limit on retention.

​
Security Headers

The ChangeGuard dashboard enforces modern security headers on every response:

​
Error Handling

API error responses for server-side failures return a generic "Internal server error" message. Detailed error information is logged server-side only and never exposed to clients. This prevents information disclosure that could aid attackers. Validation errors (400-level) return specific, actionable messages to help users correct their input.

​
Security Monitoring

ChangeGuard logs security-relevant events for monitoring:
  • Login success: Email, tenant, source IP
  • Login failure: Email, source IP
  • Rate limiting: Email, source IP, endpoint
  • API key creation/revocation: Key prefix, scope, tenant
  • Integration config changes: Provider, tenant
  • Webhook blocks: URL, reason (SSRF prevention)
These logs are available via Kubernetes log aggregation on the backend deployment.

​
SOC 2 Readiness

ChangeGuard implements controls aligned with SOC 2 Trust Service Criteria:
SOC 2 Type II preparation is underway, with controls already implemented across all five Trust Service Criteria. Contact security@changeguard.ai if your organization requires a formal attestation, the current pre-audit security questionnaire, or has specific compliance questions.

​
Responsible Disclosure

If you discover a security vulnerability in ChangeGuard, please report it to security@changeguard.ai. We commit to acknowledging reports within 24 hours and providing a remediation timeline within 72 hours.