File Transfer Audit Trail: Track Who Downloaded What
Implement file transfer audit trails for compliance and security. Track downloads, access times, IP addresses, and generate reports for shared files.
A file transfer audit trail records every meaningful event in a transfer's life — upload, password attempts, successful authentication, byte ranges served, IP addresses, User-Agents, and final deletion — into an append-only log that survives disk failures and satisfies GDPR Article 30, HIPAA 164.312(b), SOC 2 CC7.2, and PCI DSS 4.0 Requirement 10. The trail answers the question every incident responder gets at 2am: who downloaded the .pdf, when, from where, and on what device. Without it, you're guessing.
What events belong in the log
Six events cover most forensic scenarios. First, upload completion: sender IP, file size, SHA-256 of ciphertext, declared MIME type. Second, link creation: expiry, max downloads, password flag, 2FA flag. Third, access attempts: timestamp, IP /24, password-correct boolean, User-Agent family. Fourth, download start: session ID, first byte served. Fifth, download complete: total bytes, duration, HTTP 2xx/4xx code. Sixth, deletion: trigger (expiry, max reached, manual revoke), timestamp, zeroization confirmation. Skip any of these and you'll have a gap the auditor notices.
Append-only storage that survives tampering
The log has to resist modification even by admins. One approach: write events to an AWS S3 bucket with Object Lock set to Governance mode (compliance mode for HIPAA) and a 90-day retention. Another: stream to ClickHouse with MergeTree's FINAL guarantee, hashed into daily Merkle roots published to a public bulletin board. Blockchain anchoring — timestamping the daily root on Bitcoin via OpenTimestamps — costs about $0.30/day and gives you cryptographic proof no one forged an event. For most teams, S3 Object Lock plus IAM separation is enough.
Structured formats auditors can parse
JSON lines work, but auditors prefer RFC 5424 syslog or the newer OCSF (Open Cybersecurity Schema Framework) for SIEM ingestion. Each event gets fields like activity_id, severity_id, time, actor.user.email_hash, src_endpoint.ip, file.hashes.sha256. Splunk, Datadog, and Elastic all parse OCSF natively. For smaller teams, a CSV export with columns (timestamp_utc, event_type, transfer_id, ip_hash, outcome, bytes) dropped into a shared drive quarterly satisfies the evidence requirement without buying a SIEM license.
IP handling under GDPR
IP addresses are personal data under GDPR (confirmed by Breyer v. Germany, 2016). You can't just log full IPs forever. Hash them with HMAC-SHA256 using a daily-rotating key, which breaks correlation after 24 hours while preserving same-day forensics. Retain raw IPs only during an active investigation with documented Article 6(1)(f) legitimate interest. Some services store only /24 prefixes, which keeps geolocation but drops individual attribution — a fair tradeoff for a free tier. Document your choice in the privacy policy so data subjects can exercise Article 15 rights.
Time-synchronization and non-repudiation
An audit trail is only credible if timestamps are accurate. Run chrony or systemd-timesyncd against NIST or Cloudflare's time.cloudflare.com, and include a clock_skew_ms field in each event so a forensic analyst knows the confidence interval. For non-repudiation, sign each log file with Ed25519 using a key stored in AWS KMS or a YubiHSM. The signature proves the log hasn't been altered post-hoc and couldn't have been forged without compromising the HSM — the kind of evidence a court accepts.
Retention periods by regulation
Different frameworks demand different windows. HIPAA requires 6 years from the date of creation or last use, whichever is later (45 CFR 164.316(b)(2)). PCI DSS 4.0 mandates 12 months immediately accessible plus 12 more in cold storage. SOC 2 defers to your policy but auditors frown on anything under a year. GDPR Article 5(1)(e) says "no longer than necessary" — interpret that as matching the retention of the business records the log supports. Set per-tenant retention in your database schema and run a monthly purge job that re-signs the remaining segments.
Generating reports that humans read
Raw logs don't satisfy a regulator's request. Build a report generator that filters by transfer ID, date range, or recipient email hash and produces a timestamped PDF with the company logo, table of events, and the Ed25519 signature verifying authenticity. Include a cover page with the report's own SHA-256 hash so the recipient can detect alteration. Tools like WeasyPrint or Typst render this cleanly from a Jinja2 template. HexaTransfer exports reports as both PDF and CSV; auditors usually ask for both.
Alerting on anomalies
The trail is useless if no one reads it. Define rules that trigger alerts: more than 5 password failures in 10 minutes, downloads from an IP range that doesn't match the sender's country, access outside business hours for healthcare files, or any 4xx burst on a single link. Route alerts to PagerDuty for SOC teams or a Slack webhook for solo operators. Tune thresholds quarterly; noisy alerts get ignored, which defeats the purpose. Document the rule set so auditors see you thought about detection, not just logging.
Deletion as a logged event
The final entry in a transfer's life is its erasure. Log the trigger (expiry timer, max download count, manual revoke), the zeroization method (pass count, device type), and the post-deletion SHA-256 of the disk region to prove nothing recognizable remained. This matters for GDPR Article 17 right-to-erasure confirmations and for HIPAA breach notification thresholds. The log of deletion outlives the file itself — sometimes by years — which is exactly how a compliant system should behave.
Try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file