audit logs must be immutable and retained per regulatory requirements (typically 7 years for financial data, 6 years for HIPAA).