Every model call, on the record.

A founder building on AI asked us two questions in one breath: “Are we tracking all the AI commands, so we can revisit the prompts and tweak them? And do we have the audit trail we will need for SOC 2?” Both questions have the same answer, and most AI products ship without it.

The answer is a ledger: one database row for every model invocation. Not the content, the call. Which prompt version ran, against which model, how many tokens in and out by the model's own count, how long it took, and whether it succeeded. Written on failures too, because failures are where prompt problems actually announce themselves.

Version the prompts like code, because they are code

The prompts live in the codebase as versioned constants: extract-v1, deep-read-v1. Change the wording, bump the version. Now the ledger can answer the question every team argues about from memory: did v2 actually do better? Compare failure rates, token spend, and latency across versions with a query instead of a feeling. Prompt tuning becomes an engineering discipline with evidence, not a vibes contest.

What deliberately stays out

The ledger never stores document content. The customer's uploaded receipt is already the system of record for what went in; the extraction result already lives on the document row. Duplicating content into a telemetry table doubles your sensitive-data surface for zero information gain. The ledger holds shape, cost, and outcome. That line matters when the customer is trusting you with their books, and it is exactly the line an auditor will ask you to draw out loud.

The compliance dividend

SOC 2 and GDPR both circle the same demand: know what your automated processing does, prove who did what, show it on request. A model call ledger plus a conventional audit log answers that demand with rows instead of essays. When the auditor asks “how do you monitor your AI processing,” the answer is a screen: calls, failure rate, average latency, token cost, prompt versions in play, thirty days at a glance.

The build cost is almost embarrassing to report: one table, one write per call, an afternoon including tests. The alternative is discovering at audit time, or in a prompt regression, that your AI has been running for a year with no memory of what it did. Ship the ledger before you need it, because the day you need it, it is too late to backfill.