Full Conversation-Level Audit Log

What we need:

Admin-accessible logs that capture, per user:

Full conversation input (user prompt)

Full conversation output (AI response)

Timestamp (UTC)

User identity (linked to SSO/directory)

Model/agent used

Session ID

Why:

Under SEC Rule 204-2, AI-assisted communications that relate to investment advice or client correspondence must be retainable and producible on demand for up to 5 years. Usage/credit metrics alone are not sufficient. Examiners will ask: "Show me what your analyst asked the AI and what it returned on this date."

Requested format: Exportable via admin dashboard (CSV or JSON); ideally accessible via API for automated archiving pipelines.

---

Tamper-Evident / Immutable Log Option (WORM-Compatible Export)

What we need:

An option to export audit logs in a tamper-evident format — either:

Cryptographically signed exports (hash-verified), or

A direct integration/webhook to WORM-compliant archiving platforms (Global Relay, Smarsh, Microsoft Purview)

Why:

SEC Rule 204-2 requires records to be "true and accurate." WORM compliance (Write Once, Read Many) is the established standard for electronic records. Hatz itself does not need to be the WORM archive — but it needs to produce exports that can feed into one. A signed, hash-verified export would satisfy the "audit trail alternative" standard.

The more regulated industries NEED these. Hopefully it is easily doable via the API and we can build our own audit log if we can get the history.