By the Steadybyte team

Search for "Rails audit log" and you'll find good answers: paper_trail , audited , logidze , and many tutorials that add an after_save callback and an audits table. They all answer one question well: what changed, and who changed it?

That's often enough until your first HIPAA risk assessment, SOC 2 audit or enterprise security questionnaire. Then the questions get wider. This post walks through those questions, shows where change tracking stops, and explains how to close each gap with plain Rails and PostgreSQL. At the end we show the gem we're building for this, but everything before that section works without it.

Not legal advice. This post is about engineering, not law.…