--- title: GitHub - steadybytehq/sealed_trail: Audit trail for... description: SealedTrail is a Ruby gem that adds an audit trail to Rails Active Record models. It logs every create, update and destroy, capturing before and after values,... canonical: https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub - steadybytehq/sealed_trail: Audit trail for Rails: who changed what, when, and from where. Redaction by default; PostgreSQL, MySQL, SQLite. | daily.dev og:description: SealedTrail is a Ruby gem that adds an audit trail to Rails Active Record models. It logs every create, update and destroy, capturing before and after values,... og:url: https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic og:image: https://api.daily.dev/og/posts/lJmAv7LIC.png og:image:alt: GitHub - steadybytehq/sealed_trail: Audit trail for Rails: who changed what, when, and from where. Redaction by default; PostgreSQL, MySQL, SQLite. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub - steadybytehq/sealed_trail: Audit trail for Rails: who changed what, when, and from where. Redaction by default; PostgreSQL, MySQL, SQLite. **[Ruby Flow](https://daily.dev/sources/rubyflow)** · 13 min read · 0 upvotes · 0 comments ## Summary SealedTrail is a Ruby gem that adds an audit trail to Rails Active Record models. It logs every create, update and destroy, capturing before and after values, the actor, timestamp, request id and IP address. Bulk operations like update_all and delete_all are also recorded as summary entries. Passwords, tokens, secrets, emails, phone numbers and encrypted attributes are redacted by default, with strategies like masking or HMAC fingerprinting. It requires Ruby 3.2+ and Rails 7.1 through 8.1, and supports PostgreSQL, MySQL 8+ and SQLite. The core gem is MIT-licensed; an add-on called SealedTrail Pro is planned for view/export logging, tamper-evident hash chains, retention policies and auditor reports. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I log who changed a record and when in a Rails application? A Rails gem called SealedTrail adds this by hooking into Active Record callbacks on models you mark with 'has_sealed_trail'. It records the before and after values, the actor (user, job, or script), timestamp, request id and IP address for every create, update and destroy, including bulk operations like update_all and delete_all. Entries are written in the same database transaction as the change. _daily.dev surfaces Rails libraries like this for teams adding audit trails to their apps._ ### How do I prevent sensitive fields like passwords and emails from being stored in plaintext in an audit log? SealedTrail redacts attributes matching patterns like password, token, secret, email and phone by default, replacing values with '[REDACTED]'. Alternative strategies include ':fingerprint' (HMAC-SHA256 hash for lookups), ':mask' (partial masking like 'j***@example.com'), a custom callable, or 'false' to opt out. Rails 'encrypts' attributes are redacted automatically too. _developers weighing redaction strategies for audit logs can track tools like this on daily.dev._ ### What Rails and Ruby versions are required to use SealedTrail for audit logging? SealedTrail requires Ruby 3.2 or newer and Rails 7.1, 7.2, 8.0 or 8.1. It supports PostgreSQL, MySQL 8+ (via the mysql2 or trilogy adapter), or SQLite as the database, with jsonb columns used on PostgreSQL and json on MySQL and SQLite. _daily.dev helps Rails developers keep up with compatibility requirements for libraries like this one._ ## Similar posts on daily.dev - [Safer secrets, ZJIT, and more\!](https://daily.dev/posts/safer-secrets-zjit-and-more--gfmhoyk3i) · This Week in Rails · 1 upvotes · 0 comments - [Faster blank? checks, safer SQLite rollbacks, and more\!](https://daily.dev/posts/faster-blank-checks-safer-sqlite-rollbacks-and-more--ne6zinq7c) · Rails · 1 upvotes · 0 comments - [GitHub - sergey-homenko/llm\_cost\_tracker: Rails-native LLM cost ledger: track spend by user, feature, provider, and model with self-hosted ActiveRecord storage and budget guardrails.](https://daily.dev/posts/github---sergey-homenko-llm-cost-tracker-rails-native-llm-cost-ledger-track-spend-by-user-feature-dseexflke) · Ruby Flow · 1 upvotes · 0 comments - [37signals Dev — Rails Multi-Tenancy](https://daily.dev/posts/37signals-dev-rails-multi-tenancy-drnvqjn7b) · 37signals Dev · 0 upvotes · 0 comments - [Schema-Enforced JSON Access, Postgres Type Decoding, and more\!](https://daily.dev/posts/schema-enforced-json-access-postgres-type-decoding-and-more--r45avjrlz) · This Week in Rails · 1 upvotes · 0 comments --- Tags: [#ruby](https://daily.dev/tags/ruby), [#data-privacy](https://daily.dev/tags/data-privacy), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub - steadybytehq/sealed_trail: Audit trail for Rails: who changed what, when, and from where. Redaction by default; PostgreSQL, MySQL, SQLite.","url":"https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic"},"datePublished":"2026-10-26T02:01:47.542Z","dateModified":"2026-10-26T02:02:19.571Z","description":"SealedTrail is a Ruby gem that adds an audit trail to Rails Active Record models. It logs every create, update and destroy, capturing before and after values,...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Ruby Flow","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ruby Flow","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a21aaa8bcbbf448193a016895c90a0e1","url":"https://daily.dev/sources/rubyflow"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ruby,data-privacy,compliance","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ruby Flow","item":"https://daily.dev/sources/rubyflow"},{"@type":"ListItem","position":3,"name":"GitHub - steadybytehq/sealed_trail: Audit trail for Rails: who changed what, when, and from where. Redaction by default; PostgreSQL, MySQL, SQLite."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github---steadybytehq-sealed-trail-audit-trail-for-rails-who-changed-what-when-and-from-where-r-ljmav7lic#faq","mainEntity":[{"@type":"Question","name":"How can I log who changed a record and when in a Rails application?","acceptedAnswer":{"@type":"Answer","text":"A Rails gem called SealedTrail adds this by hooking into Active Record callbacks on models you mark with 'has_sealed_trail'. It records the before and after values, the actor (user, job, or script), timestamp, request id and IP address for every create, update and destroy, including bulk operations like update_all and delete_all. Entries are written in the same database transaction as the change. daily.dev surfaces Rails libraries like this for teams adding audit trails to their apps."}},{"@type":"Question","name":"How do I prevent sensitive fields like passwords and emails from being stored in plaintext in an audit log?","acceptedAnswer":{"@type":"Answer","text":"SealedTrail redacts attributes matching patterns like password, token, secret, email and phone by default, replacing values with '[REDACTED]'. Alternative strategies include ':fingerprint' (HMAC-SHA256 hash for lookups), ':mask' (partial masking like 'j***@example.com'), a custom callable, or 'false' to opt out. Rails 'encrypts' attributes are redacted automatically too. developers weighing redaction strategies for audit logs can track tools like this on daily.dev."}},{"@type":"Question","name":"What Rails and Ruby versions are required to use SealedTrail for audit logging?","acceptedAnswer":{"@type":"Answer","text":"SealedTrail requires Ruby 3.2 or newer and Rails 7.1, 7.2, 8.0 or 8.1. It supports PostgreSQL, MySQL 8+ (via the mysql2 or trilogy adapter), or SQLite as the database, with jsonb columns used on PostgreSQL and json on MySQL and SQLite. daily.dev helps Rails developers keep up with compatibility requirements for libraries like this one."}}]} ```