Operations & Administration (Control)
Audit log and audit evidence bundle
Who did what when in an organisation's administration — and a package with all records for an auditor, as one file with a checksum per file.
Why#
In an audit by an auditor, a supervisory authority or a customer, what counts is what is documented. Every change in the administration is logged; the package bundles the records with which, for example, the training obligation of the European AI Act can be proven.
How it works#
Click pathAdministrationAudit log
- 1Open “Audit log”: “All admin actions in <organisation>, newest first”.
- 2“Activity (top 5)” shows the most frequent actions; a click filters by them. A click on a person filters by them; “Reset filter” removes this.
- 3Every entry: action (e.g. “Invitation sent”, “Role changed”), up to three details, person and time (Fig. 1).
Fig. 1 A person's audit log entries: action, details, person and time. - 4Open “Audit evidence”: the page shows what the package contains — with current figures (Fig. 2).
Fig. 2 What the audit evidence package contains — with current figures. - 5“Download ZIP” — the package is built live from the current data; generating it is noted in the audit log.
Settings and switches#
No switch of its own in the feature catalogue — the feature belongs to its surroundings.
What the package contains#
- 01 — data processing agreement, issued to the organisation, with technical and organisational measures and a list of sub-processors (PDF).
- 02 — status of all accounts of the organisation: certificate, result, validity, verification address (CSV).
- 03 — per employee the current certificate with QR code (PDF).
- 04 — the administration actions of the last 60 days (CSV).
- 05 — the content adjustments of the last year justified by regulation (CSV).
- 06 — description of the regulatory watch procedure with a reference to the public log.
- 07 — machine-readable index with a checksum per file, for verifying the authenticity of the whole package.
Which actions are logged#
- Dashboard opened
- Employee list opened
- Invitation sent, resent, cancelled
- Employee removed or updated
- Report exported
- Role changed
Who may do what#
Both pages are opened by an organisation's administration (HR management or university administration with an organisation) and the operator — each only for their own organisation, never platform-wide.
Tips#
- The entries are immutable and kept for 365 days.
- The page shows the last 300 entries; for older ones the filter by person or action helps.
Related features#
- Data protection: deletion calendar, dry run and reportDeletion requests, their records and the data held back because of retention obligations — with a deletion calendar, a dry run beforehand and a regular report to the data protection officer.
- Tests and guardsAround 3,400 automated tests, including 142 guards that permanently prevent mistakes once made — each with a counter-check.
- Training recordsAfter completion a signed record with a verification code, a public verification page and a validity date.
- Change log and regulatory watch“What's new?” publicly — plus a log of which official sources are monitored, when they were last checked and which content was adjusted afterwards.