How do you know if someone accessed or changed something in EchOS?

Every action is recorded in a tamper-evident audit log, cryptographically chained so that any alteration attempt breaks the chain and is detectable.