Activity Audit Log: the receipts you don't want to need (until you do)

Every action your operators take inside TaxWallet — every lead view, every call placed, every comment moderated, every TOTP reveal, every export — is recorded with timestamp, user id, IP address, and tier. The data lives on the upstream API in a hash-chained ledger that's expensive to tamper with after the fact.

You hope you never need it. Then one day you do — a client's W-2 walked out of the office and you need to know which operator viewed the record and from where. The log is right there.

Three patterns we've seen offices use it for

• Incident response. Something happened — start from the affected lead, scope the log to it, see who touched it, when, and from which device.
• Training feedback. A senior preparer reviews a junior's week in the log. Which steps did they skip? Where did they ask for the live-chat assist? The data tells you what their close-rate doesn't.
• Regulator readiness. An EFIN audit lands in your inbox. You can pull the export in under a minute. Same for the SOC 2 evidence collection your auditor wants every year.

Operators see their own log in Profile → My Activity. Admins see everyone's under Users Management → Activity Reports. Tier-gated end to end.