Compliance

Auditable from day one is a different product, not a later feature

Most platforms add an audit trail when a customer asks for one. By then the shape of the data has already decided what can be proven.

July 20, 2026  ·  The Renny team

There are two ways to build a lending platform. You can build the workflow and add an audit trail when a customer asks for one, or you can decide on day one that the record is the product and build the workflow on top of it. They produce systems that look similar in a demo and behave completely differently the first time someone is asked to prove something.

The difference is not effort. It is that the second decision constrains the first. If the record has to be defensible, then a row cannot be edited in place, a scope cannot be quietly amended, and a permission cannot vanish without leaving evidence it existed. Each of those constraints removes a shortcut a developer would otherwise reach for, and each one has to be in place before the feature that would have used the shortcut gets written.

What retrofitting actually costs

An audit trail added late is usually a log of the actions the application remembered to log. That sounds adequate until you list what it cannot answer. Did anyone edit this record before it was signed? What did the borrower actually see on the screen? Was this employee authorized on the day they approved it, or only today? Who read this file, and when?

None of those are logging problems. They are data-model problems. You cannot log your way to knowing what a scope looked like before an edit if the edit overwrote the row.

A log tells you what your software chose to mention. A record tells you what happened.

The three decisions that have to be early

• Nothing is destroyed. Retiring a record means writing down who, when, and why, and keeping the row. Once one table allows a hard delete, the guarantee is gone platform-wide, because nobody can tell you which tables are trustworthy.
• Agreements are versioned, not edited. The version somebody signed has to stay exactly as it was. That means a change is a new version, which means every downstream calculation has to be able to point at a version rather than at "current".
• Authority is time-bounded. Permissions carry a start and an end, and the end is recorded rather than applied by deletion. Otherwise "were they allowed to do that" is only answerable in the present tense.

Why this is a commercial argument, not an engineering one

A lender being examined is not looking for a feature. They are looking for whether the answer to a question exists at all. If it does, the examination is administrative. If it does not, the examination becomes an investigation into how the lender oversees its merchants, and the cost stops being measured in staff hours.

That is the whole case for deciding early. Retrofitting produces a system that can tell you a great deal about what it did, and very little about what is true.