Audit trails
Forest records every action against the record it touched: actor, change, data accessed, reasoning. The same structure applies to humans, agents, and automations.

Logging happens as actions happen. Reports are queries against the log, not reconstructions after the fact.
Record-level events
Every action targets a record. The log entry sits with the record, not in a separate stream you have to join.
Human, agent, automation, and team
All actors log the same way. Each team sees the logs relevant to their scope, without exposing records outside it.
Reasoning traces for AI
When an agent acts, the inputs and reasoning are part of the same entry as the action and outcome.
Append-only and signed
Log entries are write-once and signed at write time. Updates create new entries; the prior state remains queryable.
Live, scoped exports
Filter by case, customer, jurisdiction, or window. Export as a bundle, webhook, or sync.
Search and filter
Find any action by actor, date, record, collection, or action type. Useful for incident investigation, not just compliance exports.


Built for regulated industries
Aligned with the major frameworks
Structured exports that meet FCA, MiCA, SOC 2, and similar documentation requirements.
Regulator-ready access
Provision scoped, read-only access for regulators and external auditors without exposing your full environment.
Tied to your approval workflows
Approval requests, decisions, and escalations are logged with the full chain, so you can prove controls were followed.
Vendor agnostic
Frequently asked questions
You still have question ?
Book a conversation with a forest expert
What gets logged?
Every action against a record: actor, inputs, data accessed, reasoning (for agents), outcome, and any approval. Actions by humans, agents, and automations all use the same log structure.
Is the log tamper-evident?
Yes. Entries are append-only and signed at write time. Subsequent changes create new entries rather than overwriting previous ones.
Where is the log stored?
Inside your environment. The Forest Agent stores the log alongside the operational data it audits. Retention is configured per environment.
Can we forward logs to our GRC or SIEM?
Yes. Forwarding is supported via webhook (per event), via scheduled sync (to a warehouse), or via direct API. Common destinations include Drata, Vanta, Sprinto, Datadog, Splunk.
How do we generate a regulator bundle?
Select a case, customer, jurisdiction, or time window. Forest produces a bundle of actions, reasoning, supporting documents, and outcomes, generated live.
Does the audit cover multiple environments?
Yes. Dev, staging, and production each have their own audit log. Logs are scoped per environment and can be reviewed independently.
How long are logs retained?
Retention is configured per environment. Logs live in your infrastructure, so retention follows your own governance policy.

