Access logs
The access log records who read personal records, where in the service, and why. Edits are already in the audit log; the access log covers reads: contacts, interactions, expenses, data-request exports and other records about people.
Owners read it under Trust → Access logs.
What is logged
One entry for each successful read of personal records:
| Field | What it holds |
|---|---|
| When | The time of the read |
| Actor | Who read: a member, or the system |
| Route | The address inside the service that served the read |
| Record type | What kind of record was read, as a short code (for example contact) |
| Record IDs | The records read: up to 100 IDs, plus the full count when a list returned more |
| Purpose | Why this read needs personal data, in a few words |
| Request ID | An ID that matches the entry with the server's logs and the audit log |
A read that fails leaves no entry. A read that succeeds always has one, because the entry is saved together with the read.
The log is append-only: nobody can edit or delete an entry, owners included. Entries are kept for 730 days by default (at least 365), then deleted by the nightly retention run.
Reading the log
Filter by:
- record type;
- actor: who read;
- record ID: everyone who read one record, such as one contact.
The list is newest first.