paper_trail, audited and logidze answer “what changed, and who changed it?” well. HIPAA and SOC 2 reviews also ask who viewed or exported sensitive data, whether the log itself can be trusted, how long it’s kept, and whether you can produce evidence. This article walks through each gap with plain Rails and PostgreSQL code (read logging, a hash chain, an append-only table, a retention job) and compares the existing gems. It also introduces sealed_trail, a new MIT-licensed audit gem, though everything in the article works without it.