Data security for Security log data ingested in Google Chronicle SIEM.

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. 

Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?