Audit Trails & Immutable Logging: Compliance Forensics for Retail

HMRC, GDPR, and PCI regulations all require that you can prove what happened and when. The challenge: a simple database record can be edited (accidentally or maliciously) after the fact. Solution: immutable audit trails using hash chains — mathematically prove that a transaction cannot be changed without detection.

Real scenario: HMRC audits you 2 years after a transaction. You claim 'This transaction was £100 with £20 VAT.' But what if a database backup was restored incorrectly, or a staff member edited the record to hide a mistake? Without proof of immutability, you lose the audit.

A hash is a one-way fingerprint of data. Change the data 1%, the hash changes completely.

Example:

• Transaction 1: {date, items, amount} → Hash A (SHA-256)
• Transaction 2: {date, items, amount} + Hash A → Hash B
• Transaction 3: {date, items, amount} + Hash B → Hash C

If someone tries to edit Transaction 2 after the fact:

• Old Hash B breaks (because it was computed from Transaction 1's old data)
• New Hash B doesn't match Transaction 3's reference
• Audit trail shows tampering detected ✓

This is how Bitcoin and blockchains prove immutability.

Instead of editing transactions, create new versions:

```

pos_transaction_history:

• transaction_id (FK)
• version (1 = original, 2 = amended, 3 = refunded)
• state_json {all fields at that point in time}
• hash: SHA-256(previous_hash + current_state)
• changed_at: timestamp
• changed_by: cashier_id or 'system'
• change_reason: 'created' | 'refund' | 'amendment'

```

Benefits: Complete history preserved, cannot edit past records, auditors can verify entire chain, compliance proof automatic.

When HMRC audits you, export your audit trail as CSV:

• Every transaction with full history
• Line-by-line tax applied
• Staff who made changes, timestamps
• Hash chain (for regulator verification)
• Opening/closing cash balances

Regulator can verify: 'Is this hash chain mathematically valid? Were all changes logged? Are no transactions missing?' Answer yes to all = audit proof.