Audit trail & evidence
Evidence you can hand over, not a story you reconstruct.
The hard question after an incident is never what was done — the ticket says that. It is who authorised it, on what basis, and whether the check that was supposed to happen actually did. Most desks answer that from memory. Certra answers it from the record.
Written once, appended only
Verification results, approvals, denials and credential retrievals are recorded as they happen and cannot be edited or deleted afterwards — only added to. A trail that can be tidied up is not evidence, and everyone in the room during a review knows it.
The questions clients and auditors actually ask
Who requested this. What was checked. Who approved it, and were they entitled to. When was that credential last released, and for which ticket. Certra is structured around those questions, so the answer is a query rather than a week of reading email threads.
Evidence for the frameworks you're already held to
Cyber Essentials, ISO 27001 and most client security questionnaires ask you to show that access changes are authorised and logged. An immutable trail of verifications and sign-offs is the artefact those controls are asking for — produced as a by-product of the work rather than assembled the week before an assessment.
In short
What you get
Immutable by design
Entries are appended, never edited or removed.
Tied to the request
Every check and sign-off attaches to the ticket that caused it.
Answers on demand
Who asked, what matched, who authorised, and when.
Questions
Frequently asked
What exactly does Certra record?
For each sensitive request: the factors tested and their results, the security rating, the approver and their decision, any credential released, the person who performed the action and the time. Each entry attaches to the ticket and cannot be altered afterwards.
Can an administrator edit or delete the audit trail?
No. The trail is append-only — corrections are recorded as further entries rather than changes to existing ones, so the history of a request stays intact including the parts nobody enjoys reading.
Does this help with Cyber Essentials or ISO 27001?
It produces the evidence those frameworks ask for around authorising and logging access changes. Certra is not a certification, but the trail is the artefact assessors and client questionnaires typically want to see.
Know who you’re really talking to, before you act.
Thirty minutes, using one of your real client accounts. We’ll set up its verification flow and run a live check with you.