Joripo- Home
- Documentation
- Security and privacy
- The activity log
Security and privacy
The activity log
An organisation's own audit trail: what is recorded, who can read it, filtering and downloading it, and what is never shown.
Joripo documentation · https://joripo.com/docs/security-and-privacy/activity-log
Configure › Activity log lists what was done in your organisation, newest first. It is the organisation's own view of the server's audit trail, which records one event for every action that changes something, including actions that were refused.
What is recorded
Changes to the case list and to each case (from uploads, from submitted data, assignments, rounds, reviews and notes), reviews of quality findings and of submissions, corrections, garbling (opening the vault, exporting or destroying a key, downloading a roster), identifying datasets opened, privacy settings and identity access, forms moved, phones and device keys, workspaces, and, for owners, people, roles, sign-ins, API tokens and the organisation's settings.
Passwords, codes and keys are never recorded, and neither are answers: a correction names the field it changed, not the value; a case note is recorded as written, not what it says.
Who reads it
- Owners see every event of the organisation.
- Managers see the events of the workspaces they manage, and none about people, sign-ins, tokens or the organisation's settings.
- Reviewers and data collectors do not have the page.
Filtering and downloading
Filter by workspace, kind, person (part of an email address), from and to dates (whole days, UTC) and outcome (done, refused, failed). The filtered view is a link you can share with another owner or manager, 50 events to a page. Download (.csv) gives the filtered events, up to 10,000 at a time, in the same words as the page; each download is itself recorded.
What is never shown
- What the server's maintainer did to your organisation shows as Joripo server maintainer, without naming the person.
- Network addresses are never shown.
- A case list marked as holding identifying data keeps its case IDs, labels and values hidden from anyone without identity access to that workspace, and a finding review's note is shown only to people who see respondents' identities there.
Nothing in the log can be edited or deleted, from here or anywhere else.