I work for the goverment and one project targets employees that might apply something from their employer, for example a vacation period. They login with username and password.
I want to record their actions and be able to proof that they did so, for example, when one asks for 3 days off, I must record it in a way so I can prove the time and what they asked. So later they can't deny it.
Currently, the best I can do is to log all the data (PHP 7.3 $_SERVER, $_POST, $_GET, $_SESSION), get a trusted timestamp from our official TS provider and save this. Server, Centos 7.
How do I proof however that this data is not manufactured? The connection is encrypted, so I can't get the employee's ISP do return any logs. We also own the server so there is no 3rd party server provider to ensure the traffic.
Is there a way?
Thanks for your help.