Audit integrity

The audit log is hash-chained, and its head is periodically published to an external, operator-uncontrolled store. That is what makes tamper provable to someone who does not trust this operator's database — including the operator.