The audit trail

Nothing here can be quietly deleted. Including by us.

Most of this trade runs on email attachments and memory. A Nelum order keeps its own record instead — every document, request, message and confirmation, held so that changing it later leaves a mark that both parties can see.

An order is not a workflow with ten stages. Every company runs its own fulfilment and every jurisdiction demands its own paper, so Nelum stopped pretending to know the sequence — and put its effort into the record instead.

What a broken record costs

None of these are hypothetical failures. They are the ordinary consequence of keeping a trade's paperwork in the places this trade normally keeps it.

The version nobody can identify

Three assay certificates for the same parcel arrive over five weeks. Two are drafts, one is final, and all three are called assay.pdf. The email thread that would tell them apart belongs to a trader who left in March.

On Nelum they are one label with three versions, in order, each stamped with who added it and when. The current one is at the top; the earlier two did not disappear to make room for it.

The document that quietly changed

A certificate of origin is replaced after a question is asked about it. The new file has the same name, sits in the same folder, and reads slightly differently. Nothing anywhere records that a different document was there first.

Replacing a file here does not overwrite anything. The earlier version stays on the record, and the act of replacing it is itself an entry in the trail. If a document changed after a question was asked, the sequence shows it.

The message that was never sent

A dispute turns on whether the buyer was told about a delay. One side produces a screenshot. The other says it was never received, and both are working from private inboxes with no shared record.

Messages on an order sit in one thread both parties see. A note can be corrected — people make mistakes — but the correction is marked and the previous wording stays readable to both sides.

The review that comes two years later

A compliance function, an auditor or a tax authority asks how a specific parcel reached a refinery: who sold it, what was known about its origin, what was requested, what was produced, and what was accepted.

That is a reconstruction job across mailboxes, drives and memory — or it is one order page, still assembled, with every document, request and confirmation in sequence.

Four guarantees, and how each one is kept

These are properties of how the record is stored, not policies we ask you to trust us on.

Documents version. They never overwrite.

Upload a file under a label that already exists and it becomes the next version of that label. Both versions stay listed, in order, each showing who added it and when. Nothing is replaced, so nothing has to be trusted to have stayed the same.

v1 and v2 both remain openable by both parties.

Removals leave a mark.

A document can be withdrawn — files get uploaded to the wrong order, and refusing to allow that just produces a record nobody trusts. What removal does not do is erase history: the entry stays in place, struck through and stamped with the date it was removed, and the removal posts to the order's message thread.

Only the party who uploaded a document can remove it.

Edits keep their previous text.

A note can be corrected. When it is, the wording that was there before is saved first and stays readable by both parties — the note is marked as edited and every earlier version sits one click behind it. A statement about a consignment can be revised in the open. It cannot be quietly reworded.

The previous text is stored before the new text is written.

The trail is derived, not written.

The activity view is not a separate log that some part of the system remembers to append to. It is assembled from the documents, requests, confirmations and messages themselves, every time it is opened. A log can fall out of step with what actually happened; a derivation cannot.

Nothing writes to the trail, so nothing can omit from it.

One order, as the trail reads it

A seller uploads the wrong export licence, notices, and replaces it. The point is not that the mistake was prevented — mistakes are not preventable. The point is what the record says afterwards.

Both parties see this same sequence. Neither can produce a different one.

Offer accepted — order opened
21 Apr · Both parties
Seller uploaded Soft Corporate Offer (sco-volta-bullion.pdf)
22 Apr · Volta Bullion PLC
Buyer requested Export licence — “Ghana Minerals Commission licence covering the July lot, needed before we release settlement”
29 Jul · Abuja Metals
Seller uploaded Export licence against a request
30 Jul · Volta Bullion PLC
Seller uploaded Export licence (v2) — the first was for the June lot
31 Jul · Volta Bullion PLC
Seller removed Export licence (v1) — the file stays on the record
31 Jul · Volta Bullion PLC
Buyer confirmed the order is fulfilled
2 Aug · Abuja Metals

Who can see what

A complete record is only safe if its boundaries are just as strict. These are enforced in the database, beneath the application — not by the screens you are shown.

The two parties to the order

Everything on that order: documents and their versions, requests, messages, confirmations, and the full trail.

Nothing withheld — this is their record.

An engaged laboratory, vault or carrier

The physical facts of the job they were engaged to do.

Never the price, the fee, the settlement wallet, or the other party's legal name.

Anyone else on the marketplace

Nothing. Documents belong to an order, and an order has exactly two parties.

No cross-order visibility exists, in the product or in the database.

Nelum staff

Access for support and verification, recorded in an audit log with the acting person, the action, a justification, IP and timestamp.

Never silently — acting as a company shows a persistent banner to that company.

What Nelum cannot do

A record is worth what the platform holding it is prevented from doing to it. These limits are the product, not a disclaimer at the bottom of it.

We cannot read your documents: Files go to private storage. There is no content inspection, no extraction, no indexing of what is inside them. The label the uploader chooses is what both parties see — which is also why the label matters.
We cannot change your record: There is no administrative edit for a document row, a message or a confirmation. Support can help you use the product; it cannot rewrite what the product recorded.
We cannot hold your money: Nelum is not a bank, broker, dealer or escrow agent. Where settlement runs on-chain, the wallet is the buyer's own and our role is read-only verification. Bank instruments stay between you and your banks.
We do not decide when you are finished: An order completes when both parties say it is fulfilled. There is no stage counter that closes a trade on your behalf, because no two companies in this trade run the same fulfilment.

The five questions a review actually asks

Whether it comes from your own compliance function, an external auditor, a refiner's onboarding team or a tax authority, the questions are largely the same — and they are asked long after the trade closed.

01Who did you trade with, and did you check them?: The counterparty is a company that completed business verification before it could trade — registration, control, and sanctions screening — with a named representative whose identity was checked.
02What did you ask for, and what did you get?: Every request carries what was asked for, the reason it was needed, who asked, and whether it was answered. Every document carries its label, its versions, and who added each one.
03Did anything change after the fact?: Versions, removals and edits are all in the trail with their timestamps. A document replaced after a question was raised reads as exactly that.
04How long do you keep it?: Verification and transaction records, and the documents supporting them, are retained for at least five years after the end of the business relationship — longer where local law requires it.
05Can you produce it per consignment?: Yes. Records sit on the order, never rolled up across orders — which is what OECD five-step due diligence and chain-of-custody schemes require when a single intake draws on more than one source.

Nelum provides the record. It does not certify origin, quality or lawful ownership, and it does not perform your due diligence for you — those remain yours, which is precisely why the evidence has to be yours too.

Questions people ask about this

If I can delete a document, how is this an audit trail?: Because deleting is itself recorded. The entry stays in the list marked as removed with the date, the removal posts to the message thread, and the underlying row is retained. What you cannot do is make it look as though the document was never there.
Can I edit a message to say something different?: You can correct it, and the correction is marked. The previous wording is stored before the new wording is saved, and both parties can read every earlier version. Editing is a revision in the open, not a rewrite.
What about the automatic messages?: Every upload, request and confirmation posts a note to the thread automatically. Those are statements of fact about the record, so they carry no edit or delete — not for either party, and not for us.
Who owns the documents?: You do. Nelum stores them and controls access to them for the parties on the order; we make no claim to them and do not use them for anything other than serving them back to those two parties.
Does the trail cover the marketplace as well as orders?: Offers carry their own record — what was offered, when, and how it was answered, including a decline and its reason where one was given. The document space begins when an offer is accepted and an order opens.

Start keeping the record from the first trade

Registration and verification cost nothing. The audit trail is on every account, on every tier, from the first order onwards.