Traceability & privacy
Purpose
Two questions that belong together: who changed what? and which data are we still allowed to hold?
The log answers the first — completely, not by sampling. Subject rights and retention rules answer the second. Together they are the difference between "we believe it was correct" and "we can show it".
Scope
- Every writing action is logged — create, change, delete, restore — each with the state before
and after and the fields that changed.
- The actor is distinguished: human, AI or automation. That answers "who changed this?"
even when nobody was at a screen — and those are precisely the cases that stay unexplained elsewhere.
- Every action carries an operation identifier, through which all changes from a single click can
be brought together.
- The log is immutable. It cannot be edited or deleted; a log that could be altered would not be
one.
- Soft deletion with a 30-day period. Deleted items stay restorable for a month.
- Data subject requests — access, rectification, erasure — are handled as cases, so that their
completion is evidenced.
- Retention rules remove data once its substantive period expires. Modules register their own
data holdings for this.
Interplay
The log captures actions from every route alike — interface, API, automation and AI. The working surfaces are the audit log, the recycle bin and the GDPR page.
Limits
- Writing actions only. Pure reading, searching and exporting produce no entry.
- The log restores nothing. It shows the earlier state; bringing things back is the recycle bin's
job, within its period.
- Recycle bin and retention are two different things. One is a grace period against mistakes, the
other planned removal. Neither replaces the other.
- A disabled module does not register its data — erasure and retention do not reach it.