合规清单 · Audit Trail
文件审计追踪：PDF 工具该留下哪些记录 / File Audit Trail: What a PDF Tool Should Record
审计追踪要回答四件事：谁、什么时间、对哪份文件、做了什么操作。四类工具的记录能力差别很具体，义务先定，工具后挑。
阅读约 8 分钟 · 8 min read
一句话结论 / Short answer
审计追踪要回答四件事：谁、什么时间、对哪份文件、做了什么操作。PDF 工具在这件事上的差别可以讲得很具体：在线服务能给出账号级日志，但文件已经离机；桌面软件只在本地留文件，操作记录要靠操作系统；浏览器本地工具两样都不给，除非自己补。这三种里没有哪个天然正确，要看这份文件的记录义务落在哪里。
An audit trail answers four questions: who, when, which file, and what was done. PDF tools differ on this in a way you can state precisely. An online service produces account level logs, and the file has already left your machine. Desktop software leaves files on disk and no record of the operations, so whatever exists comes from the operating system. A browser-local tool gives you neither, unless you add the logging yourself. None of the three is automatically right, because the question is where the record obligation for this particular file sits.
判断顺序是：先确定这份文件有没有留痕义务，再看义务要求记到哪一层，最后才轮到挑工具。跳过第一步直接比工具的日志功能，是最常见的浪费时间的方式。义务不存在时，记下来的东西没人看；义务存在时，工具自带的日志往往记不到要求的粒度。
The order matters. Establish whether the file carries a logging obligation at all, then find out how deep that obligation goes, and only then pick a tool. Comparing log features before the first step is the usual way to waste an afternoon. With no obligation, nobody reads what you recorded. With an obligation, the built-in log usually stops short of the granularity required.
留痕义务的来源大致有监管、合同、内部制度和诉讼保全四处。医疗与金融走行业监管，供应商协议里常带审计权条款，单位内部的保密与分级制度会规定谁经手什么，而律师在保全阶段要的那份操作说明同样是留痕。来源不同，要求记录的字段和保存期限也不同。
说明：下面是给工具选型和内部流程用的核对口径，不是法律意见。落到具体责任判断时，以本单位法务或外部律师的意见为准。
审计追踪要记的四件事 / What has to be captured
四个字段能覆盖多数框架的要求，它们也对应着四个问题。
Four fields cover most of what any framework asks for, and they map onto four questions.
谁 / Who
要能定位到一个具体的人或一个具体的系统账号。共享账号是最常见的失效点：日志里写着某个部门账号做过什么，而三个人都能登。审计时这等于没记。
什么时间 / When
时间戳要带时区，来源还得可信。系统本地时间可以改，改完之后整条链的可信度就没了。跨时区团队用 UTC 存、用时区渲染，是最省事的做法。
哪份文件 / Which file
标识要稳定。文件名会改，路径会挪，文件夹会重命名。用哈希或生成时就定下来的文件 ID 更稳，文件名作为辅助字段保留。
做了什么 / What
记录操作类型和结果：合并、挑页、导出、删除，成功还是失败。只记成功不记失败的日志，在调查时价值有限。
第四项是多数工具悄悄停下的地方。一个不写日志的合并工具根本不产生任何一行，这次操作到底有没有跑过，只能靠文件修改时间和当事人的记忆去还原。
That fourth field is where most tooling quietly stops. A merge tool that records nothing writes no line at all, and whether the job ran at all has to be reconstructed from file modification times and whatever the person remembers.
三类工具各留下什么 / What each kind logs
把一次合并拆到记录这层，在线上传服务、桌面软件和浏览器本地工具给出的东西差别很大。
Take one merge down to the logging layer and the three routes produce very different things.
| 记录位置 | 在线上传服务 | 桌面软件 | 浏览器本地工具 |
|---|---|---|---|
| 操作日志 | 服务端有，账号级，通常可导出 | 多数没有，个别有本地历史文件 | 默认没有 |
| 文件去向 | 副本在对方服务器，删除靠对方承诺 | 在本机磁盘 | 全程不出本机 |
| 时间戳来源 | 服务器时钟 | 操作系统时钟 | 操作系统时钟 |
| 能导出成证据 | 取决于套餐，免费档常常不给 | 几乎没有 | 需要自己记 |
| 第三方能否看到 | 服务方及其依赖方能看到 | 不会 | 不会 |
第一列看着最完整，代价写在第二行。文件一旦上传，日志的完整性是用副本的外流换来的，两者不能同时拿到。这也是为什么合规评估里常听到的第一个问题是能不能在本机跑完，本地路径的能力边界见 /blog/offline-pdf-merge-limits。
The first column looks the most complete, and the cost sits in row two. Once the file is uploaded, log completeness has been bought with a copy leaving your control, and you do not get both. That is why reviewers so often start by asking whether the job can finish on the device, a question whose boundaries are set out in /blog/offline-pdf-merge-limits.
第三列不是没有答案，而是答案需要自己补一行。浏览器本地处理的好处是文件不出设备，代价是没有现成的操作日志。补法写在下一节。日志与临时文件在架构上的差别见 /blog/client-side-vs-server-side-pdf-tools，怎么自己验证零上传见 /blog/devtools-network-tab-privacy-guide。
七条记录线 / Seven lines to check
下面这张表按顺序列出每条记录线该有什么，以及一眼能看出来的缺失信号。
The table lists what each line should contain and the signal that tells you it is missing.
| 记录线 | 应包含的内容 | 缺失时的信号 |
|---|---|---|
| 操作人 | 唯一账号或具名个人，非共享账号 | 日志里出现部门名或角色名 |
| 时间戳 | 带时区的时间，来源为可信时钟 | 只有本地时间，且能随意改 |
| 文件标识 | 哈希或稳定 ID，文件名作辅助 | 只记文件名，改名即断链 |
| 操作类型 | 合并、挑页、导出、删除分别记 | 只有「已处理」一个状态 |
| 结果状态 | 成功与失败都记，含失败原因 | 只有成功记录 |
| 副本流向 | 是否产生第三方副本，保存多久 | 说不清对方保留了什么 |
| 保存期限 | 存多久、谁批的、到期怎么删 | 没有期限，日志无限增长 |
最后两行在实务里最常空着，而正是这两行决定了审计时能不能给出完整答案。第五行反过来也常见：只记成功的日志看起来干净，实际掩盖了重试和失败的那部分过程。
Those last two rows are the ones most often blank in practice, and they are the ones that decide whether an audit can be answered in full. Row five fails in the opposite direction: a log of successes only looks tidy and hides every retry and failure in between.
当天能补上的留痕流程 / A workflow you can put in place today
七步按顺序做，最后那页记录可以直接进供应商清单和内部制度档案。前三步解决要不要记和记到哪层，后四步解决能不能拿得出。
Seven steps in this order, and the last page becomes the record that goes into the vendor list and the internal policy file. The first three settle whether to log and how deep; the last four settle whether you can produce it.
- 给待处理的文件定性：有没有留痕义务，义务来自监管、合同还是内部制度，结果写进文件名或清单
- 确定记录粒度：只要「处理过」还是要到操作类型和结果，这一步决定后面要不要自建日志
- 给每份文件定一个稳定标识，哈希或生成时的 ID，别只靠文件名
- 选处理方式：需要第三方留证的场景才考虑上传，其余在浏览器本地跑完
- 本地工具没有日志，就在操作前后各记一行：谁、时间、文件哈希、做了什么、结果如何
- 导出前清一遍元数据、批注层和隐藏图层，元数据里的作者与修改时间同样属于留痕范围，各层表现见 /blog/pdf-metadata-preservation-merge
- 把这六步连同文件用途、经手人、保存期限签在同一页纸上归档，期限到期时按约定删
- Classify the file: does a logging obligation exist, and does it come from a regulator, a contract, or an internal policy, written into the file name or a manifest
- Fix the granularity: whether processed is enough or whether operation type and outcome are required, which decides whether you build a log at all
- Give each file a stable identifier, a hash or an ID assigned at creation, not just a name
- Choose the processing route: upload only where a third party has to hold the evidence, browser-local for everything else
- A local tool logs nothing, so write a line before and after: who, when, file hash, what was done, what came out
- Clear metadata, comment layers and hidden layers before export, since author and modification timestamps are part of the same record, with per-layer behaviour in /blog/pdf-metadata-preservation-merge
- Sign all six with purpose, handler and retention period on one page, then delete on schedule
合并这一步在 pdfmergenext.shop 全程本地完成，挑页码和调页序都不需要把文件交出去，第五步那两行记录由你自己写。挑页语法见 /blog/pdf-page-selection-1-3-5-syntax，上一轮商业机密的同款清单见 /blog/trade-secret-protection-pdf-merge。
Merging on pdfmergenext.shop runs entirely on your device, so selecting pages and reordering never means handing the file over, and the two log lines in step five are yours to write. Page selection syntax is in /blog/pdf-page-selection-1-3-5-syntax and the trade secret version of this checklist in /blog/trade-secret-protection-pdf-merge.
在 pdfmergenext.shop 本地合并，文件不出本机，留痕由你自己掌握 →更多 PDF 工具合规与隐私的判断细节见 /blog，医疗场景同时要对齐的要求见 HIPAA 合规 PDF 合并，个保法的八个核对点见 个保法下的 PDF 工具要求，GDPR 的同款骨架见 GDPR 合规 PDF 工具检查清单。
常见问题 / FAQ
没有监管要求的普通文件也要留痕吗？
看它在业务流程里的位置。多数内部资料不需要，但一旦这份文件会作为凭证交给外部，比如合同附件、审计报告、投标材料，留痕就从合规问题变成举证问题。判断是否属于凭证，比判断是否涉密更快。
浏览器本地工具没有日志，是不是不满足审计要求？
要看要求的是「有日志」还是「能说明谁在什么时候做了什么」。后者可以用操作前后各一行记录满足，代价是人工。前者必须靠服务端日志，而那意味着文件离机。两种满足方式对应两种不同的风险取舍，架构差别见 /blog/client-side-vs-server-side-pdf-tools。
在线服务导出的日志能直接当证据用吗？
先确认三件事：导出的是完整日志还是摘要，时间戳来源是否可核验，以及对方有没有单方面修改或删除的能力。服务方既是记录者又是被审计对象时，这份日志的说服力要打折。
日志该存多久？
跟着义务走，没有统一答案。合同审计权条款通常写明期限，行业监管各有规定，内部制度里若没写就先定一个并执行。定错期限比没有期限好处理，因为后者在争议发生时无法解释。
共享账号做的操作，日志算有效吗？
基本算无效。审计要求的是定位到具体的人或具体的系统账号，三个人都能登的账号在调查时等于没记。至少要补一层操作登记，把账号背后的经手人写清楚。
Does a file with no regulatory obligation need a trail at all?
It depends on where the file sits in the workflow. Most internal material does not. Once a file goes outside as evidence, a contract exhibit, an audit pack or a tender submission, logging stops being a compliance question and becomes an evidence question.
If a browser-local tool logs nothing, does that fail an audit requirement?
It depends on whether the requirement says a log must exist or says you must be able to show who did what and when. The second can be met with a line written before and after each job, at the cost of doing it by hand. The first needs server-side logs, and that means the file leaves your control.
Can an exported log from an online service be used as evidence?
Check three things first: whether the export is the full log or a summary, whether the timestamps come from a verifiable clock, and whether the provider can alter or delete entries on its own. When the recorder is also the party being audited, the log carries less weight.
How long should logs be kept?
Follow the obligation, since there is no single answer. Audit clauses in contracts usually state a period, regulators set their own, and where internal policy is silent, set one and apply it. A wrong period is easier to deal with than no period, because the second cannot be explained once a dispute starts.