Auditors are not asking you to be perfect. They are asking you to be able to describe what you do, show that you actually do it, and produce evidence a third party can check.
This piece walks through how we think about it at Paycux, what we have changed our minds about, and where the sharp edges are.
How webhooks work
Consider how webhooks work. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Challenges with webhooks
Consider challenges with webhooks. Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
- Keep audit events append-only and separate from user records
- Describe each control in one sentence before automating it
- Produce evidence automatically, not by hand
- Decide retention per data category, in writing
Out of Order Updates
Consider out of order updates. Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Dependent webhooks
That brings us to dependent webhooks. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Write down the control before you automate it.
Spiky throughput
Spiky throughput deserves its own treatment. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Lack of audit trail
Consider lack of audit trail. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Syncing data with the Events API
That brings us to syncing data with the events api. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Where this leaves us
If there is one thing worth taking away, it is that the expensive decisions are the ones made implicitly. Making them on purpose costs an afternoon.
If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.