Elevale maintains an immutable audit trail for compliance, accountability, and security investigations. This page describes what we log, who can see it, and how long records are kept.
What is logged
- Workspace data changes (OKRs, KPIs, tasks, wiki, business brief, process map)
- User invitations, role assignments, and permission changes
- Custom role creation and modification
- Workspace and organisation settings changes
- Admin actions (user deletion, workspace management, billing changes)
- Account and workspace deletion events
- Data exports and privacy requests
- Integration connect and disconnect events
What is not logged
- Full content of AI chat messages in audit logs (metadata such as user and timestamp may be logged separately)
- Passwords, MFA secrets, or payment card numbers
- Routine read-only page views (unless required for security monitoring)
Who can access audit logs
- Workspace admins: Compliance audit log in workspace settings; entries also appear in BD Log (cannot be deleted by users)
- Platform super admins: System-wide admin audit log for support and security
- Standard members: BD Log timeline for workspace activity, subject to permissions
Immutability
Audit log entries are append-only. Users cannot delete audit records from the BD Log timeline. Database RLS restricts write access to audit tables. Tampering with audit data is prohibited and monitored.
Retention
Audit logs are retained for 2 years, then automatically purged. Deletion evidence in data_deletion_log is retained per the privacy request policy.
Export
Workspace admins can export audit events as CSV from the Compliance audit log panel for regulatory review or internal investigations.