Illizeo keeps a trace of what happens in your space: who signed in, who changed what, who viewed sensitive data, who holds which access. This article presents the governance tools, the question each one answers, the permissions they require and how long traces are kept. It is intended for administrators, the data protection officer (DPO) and internal auditors.
Before you start #
- Most tools are in Settings › Manage Illizeo. An employee’s history is on their profile, and separation of duties applies within roles.
- Every Settings page requires the “Settings — Access” permission (Platform administration › Module access section of the role matrix), in addition to its own permission. By default, only the Administrator role holds it.
- Permissions are set in Settings › Manage Employees › Employee Roles, with three levels: Access, Execute, Admin. See Permissions & roles.
Which tool for which question #
| Your question | The tool | Where to find it |
|---|---|---|
| Who signed in, when and from which address? Who created, changed or deleted what? | User logs, “User Activity” tab | Settings › Manage Illizeo › User Logs |
| Who signed in as another employee, and for how long? | User logs, “Impersonation” tab | Same page |
| What was done with personal data: exports, erasures, breaches, reads of sensitive data? | GDPR audit log | Settings › Manage Illizeo › GDPR Audit Log |
| Who has access to what, and is that access still used? | Access review | Settings › Manage Illizeo › Access Review |
| Does one person hold incompatible roles? | Separation of duties | When adding a member to a role |
| What happened to this employee, and what was their situation on a given date? | Profile “History” tab, history of dated sections | Employee profile |
| Who changed the time and absence settings? | Time management history | Settings › Time Management › Time management history |
| Who changed this role or its members? | Role “History” tab | Settings › Manage Employees › Employee Roles |
Each tool has its own article:
- Viewing user logs
- The GDPR audit log
- Running an access review
- Separation of duties (SoD)
- Finding the change history
Permissions to grant #
| Permission (role matrix) | Section | What it opens | By default |
|---|---|---|---|
| View activity logs | Platform administration › Authentication | The user logs, both their tabs and the export | Administrator |
| Activity log retention (GDPR) | Platform administration › Authentication | Access: see the retention period; Execute: change it | Administrator |
| GDPR audit log | Data privacy (GDPR) › GDPR audit | Access: read the log | Administrator |
| View role cards | Roles & permissions › Role management | Access: view access reviews; Execute: open a review, decide, close | Administrator; Access for HR Manager, Payroll Manager and Auditor |
| Add an individual member | Roles & permissions › Members | Execute: add members to a role, and override separation of duties | Administrator |
| View the change log | Roles & permissions › History | A role’s “History” tab | Administrator |
| Time management history (time and absence audit log) | Time management › History | The time management history | Administrator; HR Manager; Access for Payroll Manager and Auditor |
The profile “History” tab has no permission of its own: each reader only sees the data they are allowed to see about that person.
What Illizeo guarantees by design #
- Traces that cannot be rewritten: entries in the GDPR audit log, reads of sensitive data and a large share of business records are tamper-evident. Each one carries a fingerprint linked to the previous entry: changing or deleting an entry would break the chain. No screen allows them to be edited, and Illizeo checks the chain every day.
- No secrets in the logs: when a password, key or secret changes, the log says “changed”, never the value.
- Reads are traced too: viewing pay, bank details, an AVS number or health data leaves a trace in the GDPR audit log.
- Hidden values: in an employee’s history, a sensitive change (bank account, pay, text of a remark) shows which fields changed, without their values.
- Minimised exports: the user log export only contains the columns on screen, each export is itself recorded in the log, and the number of exports per hour is limited.
- Bounded retention: ordinary logs are kept for 6 to 12 months, never indefinitely.
- Frozen evidence: a closed access review can no longer be edited.
How long traces are kept #
- Ordinary logs (sign-ins, sign-outs, everyday changes): the retention period set in the user logs, 6 to 12 months (12 by default). Beyond that, they are deleted every night.
- Tamper-evident entries (GDPR audit log, sensitive reads, chained records): they are not deleted by this period.
- History of dated profile sections: kept with the profile.
- Access reviews: they remain available, closed or not.
Retention periods for the personal data itself (records, documents, applications) are set elsewhere, in Data Retention. See Security & compliance, which also covers authentication, data breaches, data subject requests and impact assessments.
Good to know #
- The log retention period has effects elsewhere: an employee’s history and the last sign-in shown in an access review do not go back further, except for tamper-evident entries.
- Traces say who did what, when and about whom. They do not contain the personal data that was viewed.
FAQ #
An auditor needs to read the logs without being able to change anything. What should I grant? #
Create or adapt a role with “Settings — Access”, then the permissions of the relevant tools at the Access level: “View activity logs”, “GDPR audit log”, “View role cards”. The Access level is enough to read; actions (opening or closing a review, changing the retention period) require Execute.
The Auditor role cannot see the access review. #
By default, it holds “View role cards” but not “Settings — Access”. Grant it that permission.
