Skip to main content

Audit trail

CashXChain maintains a structured audit trail for accounts, beneficiaries, quotes, payments, balance movements, webhook delivery, user actions, and compliance-relevant lifecycle events.

The audit trail is designed for finance, operations, compliance, and engineering teams that need to understand not just what happened, but when, why, and through which workflow.

What is recorded​

CashXChain records, among other things:

  • Who acted: the user, the API key (by its id) or the system.
  • Every payout's status transitions, with the time each was recorded.
  • API requests made with a key that pass authentication, the rate limit and delegation checks, with redacted request and response bodies — see Request IDs and logs.
  • Every platform delegation decision, allowed or refused.
  • Every inbound notification from our banking partner, before it is acted on.
  • Each webhook delivery to your endpoints: its status, the number of attempts, and the HTTP status and error of the latest attempt.
  • KYB pre-check runs, as immutable records.

Payout history​

A payout records when it was created, submitted to the rail and settled (created_at, submitted_at, settled_at), and its current status.

JSON
{
  "id": "5f0c2e9a-3b1d-4c7e-8a6f-2d9b4e1c7a30",
  "status": "settled",
  "created_at": "2026-10-15T20:14:49.165Z",
  "submitted_at": "2026-10-15T20:14:49.182Z",
  "settled_at": "2026-10-15T20:14:49.187Z"
}

Exports​

Statements export an account's booked movements for any period up to a year, with a checksum a third party can verify. Request logs and webhook delivery logs are readable through the API.

Retention​

Retention depends on legal requirements, customer agreements, partner obligations, and data protection rules. CashXChain retains operational and compliance records for as long as required to satisfy legal, accounting, security, and regulatory obligations.

Best practices​

  • Use stable external references for every payment.
  • Store CashXChain ids and each response's X-Request-Id in your system of record.
  • Review request logs after operational incidents.
  • Give each service its own API key, so the log shows which one acted.