Trails

Most "audit log" plugins give you a table of changes. Trails gives you a forensically defensible record.

Every event is cryptographically linked to the one before it. Periodic Merkle roots are anchored to immutable external storage (Amazon S3 Object Lock or any RFC 3161 Timestamp Authority), giving you third-party-verifiable proof that your log existed in its current form at a specific moment in time. When auditors come asking, hand them a signed Certificate of Integrity and a 60-line Python verifier - they confirm authenticity without ever touching your CMS.

                                                                                                                                                            Trails is for Craft sites where the audit log is a legal, regulatory, or contractual artifact - not a debugging tool. If you just need recent changes for  debugging, use a free option. Trails is the right call when an external party - auditor, regulator, lawyer, client - might need to verify the log's authenticity.

Features

Tamper-evident chain

Hash chain + batched Merkle roots
External anchoring to S3 Object Lock or RFC 3161 TSA (FreeTSA supported, free)
Signed Certificate of Integrity (JSON / PDF) with bundled standalone verifier

Independently re-verifiable with aws s3api head-object or openssl ts-verify

                                                                                                                                                      Comprehensive event capture                                                                                                                                   - Element create/update/delete/restore across all element types                                                                                                - Authentication: logins, logouts, failed attempts, brute-force detection

System events: plugin install, permission changes, project config applies
Field-level before/after diffs with structured side-by-side view
Custom Event API for third-party plugins

Privacy & compliance

GDPR one-command anonymization across active and archived tables - IP truncation (/16 IPv4, /48 IPv6) and email-at-rest encryption
PII gating, excluded-field allowlist, CSV-injection protection
Configurable retention with instant table-level purge

Real-time Control Panel

Filterable logs index (htmx, no page reload)
Element timeline + user timeline
One-click integrity panel
Live polling (5s) and optional Server-Sent Events
Dashboard widget + activity dashboard

Integrations

Log shipping: Splunk HEC, Datadog, S3, signed webhooks
Opt-in GeoIP enrichment

Cooldown-throttled email alerts (failed-login bursts, mass deletions, permission changes)

                                                                                                                                                        Developer API

REST (8 endpoints, dual auth, rate-limited) and GraphQL
Fluent query builder + typed DTOs
Console commands for verify / certificate / backfill / rehash
Full config/trails.php overrides with env-var interpolation

Reporting & export

Streaming CSV / JSON / HTML / PDF - no row cap, queues automatically
PDF Certificate of Integrity for any date range

Operations & scale - Monthly table partitioning with transparent cross-table queries

Cursor-based pagination (page 10,000 as fast as page 10)
Chain backfill + hash-version migration
Granular permissions, per-token rate limits, API kill-switch

Requirements

Craft CMS 5.0+, PHP 8.2+, MySQL 8.0+ or PostgreSQL 13+, queue runner
Optional: AWS S3 bucket with Object Lock + versioning, or any RFC 3161 TSA (FreeTSA works out of the box)

Trails

Standard