Skip to the content
DIANOTrust Centre

Trust Centre › 6. Audit trail and evidence in court

Audit trail and evidence in court

Checked on 19 October 2026 · version 2026-10-19-u1

In short

Each entry shows who made the change and their role, what changed (the values before and after) and when. Nobody can edit or delete entries in the audit trail. Only DIANO's server writes them.

What each entry shows

Kept and protected

Document numbers

Getting a copy

Electronic records and South African law

This is not legal advice. It explains how DIANO's records can support their weight as evidence. Ask your attorney how the law applies to your case.

How DIANO's records support their weight

What a court looks atWhat DIANO does
How the record was made and storedEvery request is checked on Google's servers: by DIANO's database rules and by the server code. The web browser is never trusted to say who you are or what you may do. Nobody can edit or delete entries in the audit trail. Only DIANO's server writes them.
How its integrity was keptThe audit trail archive is locked for 7 years. Until then nobody can change or delete it, not even DIANO. Quotes, sales orders, invoices, delivery notes, credit notes, statements and payments are numbered in order. A number is never skipped or used twice, and these documents cannot be deleted.
Who made itEach entry shows who made the change and their role, what changed (the values before and after) and when. Every sign-in is recorded with the time, the account and the internet (IP) address.

Ask your attorney who in your business should sign a certificate for a printout or an export.

How long to keep your records

Download an export every year and keep it for as long as the law asks you to, also after you stop using DIANO.

Roadmap: planned, not true yet

Targets can move. When an item is done, it moves up into the page with its proof. The whole roadmap.

For your IT team / auditor

Each statement on this page, how it was checked and when. Every check was read-only. The full evidence (commands and their output) is available to auditors on request.

StatementHow it was checkedChecked
Each entry shows who made the change and their role, what changed (the values before and after) and when.DIANO's live server code (columns at, actorName, actorEmail, actorRole, actorUid, changed, before, after).2026-10-19
Nobody can edit or delete entries in the audit trail. Only DIANO's server writes them.DIANO's live database rules (companies/{id}/auditLog: allow write: if false).2026-10-19
Every change to your records is written to your audit trail. This covers your company details, customers, quotes, sales orders, invoices, delivery notes, credit notes, statements, payments and users.Google Cloud server functions (read-only check, 2026-10-20) (auditCompanyWrite, auditCustomerWrite, auditQuoteWrite, auditSalesOrderWrite, auditInvoiceWrite, auditDeliveryNoteWrite, auditCreditNoteWrite, auditStatementWrite, auditPaymentWrite, auditCompanyUserWrite).2026-10-19
Every sign-in is recorded with the time, the account and the internet (IP) address.Google Cloud logging and alerts (read-only check, 2026-10-20) (sink audit-logs-to-storage: identitytoolkit requests + diano_security); DIANO's live server code.2026-10-19
Each audit entry is also copied to the archive that is locked for 7 years.Google Cloud logging and alerts (read-only check, 2026-10-20) (sink audit-logs-to-storage filter includes jsonPayload.logType="diano_audit"); DIANO's live server code (logType "diano_audit").2026-10-19
The audit trail archive is locked for 7 years. Until then nobody can change or delete it, not even DIANO.Google Cloud storage settings (read-only check, 2026-10-20) (dia-accounting-audit-logs: retention 2556 days LOCKED); Google Bucket Lock page ("permanently preventing the policy from being reduced or removed").2026-10-19
Every 30 minutes a check looks for any change that has no audit entry and adds the missing entry. The platform owner gets an e-mail alert when that happens.Google Cloud scheduled jobs (read-only check, 2026-10-20) (dia-audit-reconcile */30); Google Cloud logging and alerts (read-only check, 2026-10-20) (alert "reconcile repaired a missing entry", 1 e-mail channel).2026-10-19
Quotes, sales orders, invoices, delivery notes, credit notes, statements and payments are numbered in order. A number is never skipped or used twice, and these documents cannot be deleted.DIANO's live database rules (counters move by one only together with the document they number; "no skipped, reused or forged numbers"; allow delete: if false on each of these collections).2026-10-19
A Company Admin or Auditor can download the audit trail for a chosen period, as a spreadsheet file (CSV) or as JSON.DIANO's live server code (exportAuditLog: "Only a Company Admin or Auditor"); DIANO's live server code (format csv or json, from/to dates).2026-10-19
A Company Admin can download all the company's records at any time as one ZIP file. Each kind of record is in it twice, as a CSV spreadsheet and as JSON, with a list of every file and its SHA-256 check value.DIANO's live server code (csv + json per type, manifest.json with record counts and SHA-256); DIANO's live server code (Company Admin); Google Cloud server functions (read-only check, 2026-10-20) (exportCompanyData on production).2026-10-19
Every request is checked on Google's servers: by DIANO's database rules and by the server code. The web browser is never trusted to say who you are or what you may do.DIANO's live database rules (request.auth: Google-verified sign-in token); callables check request.auth (e.g. DIANO's live server code, DIANO's live server code exportAuditLog).2026-10-19