Audit logs and evidence for procurement

Procurement reviews ask for the same evidence every time. Assemble it once and keep it current.

What the platform records

Administrative actions (channel changes, user changes, retention changes), erasure and export runs, template submissions, and campaign executions — each with actor, timestamp and target.

The pack reviewers ask for

• Executed DPA with the current sub-processor list.
• Data-flow description and instance region.
• Retention policy per data class with justification.
• Access-control model and the most recent user review.
• Incident-response and breach-notification process.

Export the audit log for the period under review and attach it. A reviewer who receives this pack unprompted usually closes the assessment a cycle earlier.