An audit is a third-party replaying your event log against external evidence — like verifying a blockchain against the real world. Your job is that the replay is possible: immutable log, linked evidence, access control. Every "can we hard-delete this?" question answers itself: no.