← Axon Interview Insights

Axon·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
May 2026

Summary

System design round at Axon focused entirely on building a tamper-evident audit log for video evidence. One big question, lots of moving parts, and they clearly expected you to drive the whole thing from requirements down to rollout.

Questions Asked (1)

Q1

Design a scalable, tamper-evident audit logging system for video evidence that maintains a verifiable chain of custody, supports legal discovery, and never loses an event. Cover requirements, architecture, storage, event schema, integrity mechanisms, encryption, access controls, scalability, APIs, retention and legal hold policies, monitoring, disaster recovery, cost trade-offs, and a testing and rollout plan.

System DesignTechnical Trade-offsData Modeling
Author's notes

This is a monster of a question.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and constraints (scale, legal standards, retention) to frame the design. Then propose a high-level architecture that ensures immutability, verifiability, and durability, diving into key components like event schema, storage, and integrity mechanisms. Finally, discuss trade-offs, operational aspects (monitoring, DR, cost), and a phased rollout plan.

Pro tip: Emphasize tamper-evidence through cryptographic chaining and digital signatures, and discuss how to handle legal holds and e-discovery without compromising scalability. Show awareness of Axon's domain by referencing evidence integrity and chain of custody standards.

1. Clarify Requirements and Constraints

Ask questions to understand scale (events/sec, data volume), legal and regulatory requirements (e.g., chain of custody, retention periods), and non-functional needs (latency, durability, cost).

2. Design High-Level Architecture

Propose a distributed, append-only log with immutable storage, using a write-ahead log for durability and a verifiable chain of custody via cryptographic hashing and signatures. Include components for ingestion, storage, indexing, and access.

3. Detail Key Components

Elaborate on event schema (metadata, hashes, signatures), storage tiers (hot/warm/cold), integrity mechanisms (Merkle trees, blockchain-like chaining), encryption (at rest and in transit), and access controls (RBAC, audit trails).

4. Address Scalability, Retention, and Legal Holds

Explain partitioning, replication, and indexing for scalability; retention policies with automated deletion; and legal hold mechanisms that override deletion and support e-discovery queries.

5. Cover Operations and Rollout

Discuss monitoring, disaster recovery (backups, multi-region), cost trade-offs (storage classes, compression), and a testing/rollout plan (canary, load testing, compliance validation).

Key Points to Mention

  • Tamper-evidence via cryptographic chaining (e.g., hash chain or Merkle tree) and digital signatures for each event.
  • Immutable storage (e.g., WORM) and append-only logs to prevent modification or deletion.
  • Event schema including metadata (timestamp, actor, action, video hash) and integrity fields (previous hash, signature).
  • Access controls with RBAC, encryption at rest and in transit, and audit trails for all access.
  • Scalability through partitioning, replication, and tiered storage; retention policies and legal hold implementation.
  • Disaster recovery with cross-region replication, backups, and monitoring for integrity and availability.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.