How Majormatic supports compliance obligations — audit log access, data export, GDPR controls, retention management, and the immutable execution record that underpins legal defensibility.
Majormatic is built around a principle that audit trails are not a feature to be enabled — they are a structural property of the platform. Every execution creates immutable records. This is not optional and cannot be disabled.
Once written, audit records cannot be modified or deleted. They form a tamper-evident record that can be produced to any regulator, auditor, or legal authority.
Execution records are linked in a way that makes any alteration detectable. The integrity of the audit trail can be independently verified.
Finalisation creates a permanent, explicit accountability boundary. Before finalisation, outputs are platform-managed drafts. After, they are user-owned decisions with a sealed audit record.
This is the operational principle. Actions not in the audit log have no evidential standing. Every action relevant to a professional output is captured.
The platform records a comprehensive set of events for every execution. All records are scoped to the organisation and accessible to admins with audit access permission.
Audit logs are accessible from the Admin Dashboard. Access requires the audit access permission. Logs are searchable, filterable, and paginated.
Filter to specific time windows for compliance investigations or periodic reporting.
Filter to all executions performed by a specific user — useful for individual accountability reviews.
Filter by app or engine type to review all runs of a specific workflow category.
Filter by lifecycle state (Finalised, Failed, Cancelled) to find incomplete or problematic runs.
Audit data can be exported in multiple formats for use in compliance reporting, legal proceedings, or internal governance reviews.
Full machine-readable audit export. Includes all fields and nested metadata. Suitable for importing into compliance management systems or custom reporting tools.
Tabular export of execution records. Suitable for spreadsheet analysis, reporting tools, and compliance dashboards.
Human-readable formatted report. Suitable for presenting to auditors, regulators, or legal proceedings.
Majormatic is GDPR-aligned. The platform is designed to support compliance with data subject rights requests. Admins are responsible for responding to requests from their organisation's users and processing them through the Admin Dashboard.
Users may request a copy of their personal data. Admins can generate a data export for specific users from Admin → Data → User Export. The export includes account data, execution metadata, and billing records.
Users may request deletion of their personal data. Admins can initiate a deletion request from Admin → Data → Delete User Data. Execution audit records required for legal compliance obligations may have extended retention — these are flagged clearly.
Users may request correction of inaccurate personal data. Account profile data can be updated by the admin. Execution records are immutable — they cannot be corrected as this would undermine audit integrity.
Users may request their data in a portable format. The JSON export format satisfies portability requirements. Admins can generate a user-scoped JSON export for this purpose.
Majormatic uses a 3-layer data architecture with distinct retention rules for each layer.
Uploaded input documents and raw execution evidence. Temporary — active 30-day window by default. Vault extension is available for continuity beyond the active window.
Structured execution outputs and associated metadata. Linked to execution records. Retained for the duration of the active workspace plus any vault extension purchased.
User annotations, overrides, and acknowledgement events. Governed retention — duration determined by compliance policy and applicable law. Always transparent to the owner.
All data in the platform is classified into one of three categories:
App catalogue metadata and publicly available information. No access restrictions.
User inputs, outputs, and account data. Accessible only to the data subject and authorised organisation admins.
Data subject to specific legal or regulatory handling requirements. Additional controls apply.
Admins bear specific compliance obligations for their organisation's use of Majormatic. These are distinct from what the platform itself guarantees.