Change one character in the audit trail. The system refuses to start.
Every record is mathematically linked to the one before it. If anyone — employee, attacker, or even an administrator — edits, deletes, or reorders a single entry, the system spots it and halts. An auditor verifies the entire trail using only your public key. No access to your servers required. No trust in us required.