Tracking 1M+ audit log events / month in PostgreSQL – with backup & replay
How we built a single operating record covering the full financial, legal and HR lifecycle of an Italian company — assembled from external sources, and never written without a trace.
An Italian company's operating record is unusually demanding.
It has to model e-invoice document types, self-billing, tax payment forms, withholding, occasional-work engagements and statutory leave — a lifecycle most general-purpose systems only approximate.
And it spans accounting, legal and HR rather than sitting neatly inside any of them.
Two things shaped everything else:
Step 1: Most of the data originates outside the company
Invoices arrive as structured XML. Bank activity arrives as exports. IBANs are validated against an external service before they're trusted. Addresses are geocoded.
Meetings arrive as recordings and become speaker-labeled transcripts. Documentation is translated between English and Italian with its markup intact. Manufacturing activity is read from the ERP itself.
18 external sources at launch, with more added over time. Each one arrives through a single ingestion function rather than a custom import, and lands already verified against the system that owns it.
Supplier invoices then reconcile against bank movements automatically, carrying an explicit match state rather than a manual tick.
Step 2: Nothing may change without leaving a trace
Every write passes a row-level policy in PostgreSQL before it lands. Every row that lands fires a trigger recording the previous value, the new value and exactly which fields changed.
That audit log isn't a report anyone reads. It's the replication mechanism.
Unsynced rows are replayed into an independent standby database, which in turn serves a read-only copy of the entire application for disaster recovery.
One mechanism, three jobs: permissions, history, recovery. Nothing can be changed quietly, because the company follows strict regulatory compliance that requires clear understanding of who did what, when and with which permissions.
A lifecycle no generic system models
E-invoice types, self-billing, withholding and statutory leave, across accounting, legal and HR at once.
Data that originates elsewhere
Eighteen outside sources at launch, each with its own shape and its own failure modes.
Changes that must never go unrecorded
Every write carries its old value, its new value and the fields that moved.
Every change is recorded, and everything can be rebuilt.
Compliance issue resolution no longer takes days of investigation. The record answers who changed what, when, and under which permissions — directly, from the log itself.
Supplier invoices and bank movements reconcile themselves, carrying an explicit match state rather than a checkmark in a spreadsheet.
Every change in the system is attributable — who, when, which fields, what the value was before — without anyone having to remember to log anything.
Disaster recovery stops being a periodic backup and becomes a continuous consequence of how writes work. The second copy is never more than a replay behind.
The finance, legal and HR departments have a single place to verify what happened downstream that led to compliance issues, providing quick resolution.
Data problems shaped like this one?
If some of this reads like your situation, say which part. Datsugi replies within 2 business hours, guaranteed (CET).
Arrigo Lupori
Founder & Managing Director