Audit logs track who did what, when and from where. They are the safety net for your internal controls, your leak investigations, and the access evidence your own compliance programme requires.
Auto-tracked events #
| Category | Events |
|---|---|
| Authentication | Login, logout, failure, MFA, SSO |
| Employee data | Creation, edit, delete, sensitive read |
| Payroll | Payslip generated, approved, sent, edited |
| Permissions | Role granted, revoked, edited |
| Exports | Bulk download, API, integration |
| Documents | Download, share, delete |
Step-by-step #
-
Open the Audit module #
Security → Audit logs. Filters by date, user, category, severity.
-
Investigate an event #
Click a row to view the detail: payload, IP, user agent, before and after state.
-
Monitor sensitive actions #
There is no automatic alert on an audit-log event: no sensitive action triggers a Slack or email notification from the logs. Monitoring is done by opening the screen and by exporting.
-
Export for external audit #
Export of the filtered rows from the screen. Chain-integrity verification runs server side and returns an overall verdict rather than a file.
-
Retention #
Set per customer workspace, in months, from the User logs page.
FAQ #
Are the logs tamper-proof?
No, and we will not write that. Immutable entries are cryptographically chained: each row carries the SHA-256 hash of the previous one. The exact guarantee is detectability: any modification, deletion or reordering of an already-chained entry is caught when the chain is recomputed. On infrastructure we operate, no purely internal mechanism can make a log impossible to alter; it can make it impossible to alter quietly.
Is everything chained?
No. Only entries marked immutable — transactional mutations and break-glass access. The organisational history, editable by design, is not chained.
Is there qualified third-party timestamping?
Not today. A slot for an RFC 3161 timestamp token exists in the checkpoints, but it is not implemented: verification is entirely local, with no network call and no external provider.
How long are logs kept?
The window is set per customer workspace, in months, from the User logs page. Past that, entries are permanently deleted — they hold personal data (email address, IP, user) that has to be erased.
What about GDPR?
The log records who accesses personal data, which directly supports demonstrating access control. It is itself subject to a retention period, hence the purge.
What does not exist #
No CEF export and no Splunk, Datadog, Sentinel or Sumo Logic connector. No real-time syslog or webhook stream to a SIEM. No automatic alert on an event. No partial anonymisation of older logs: past the retention window they are deleted, not anonymised.
