Security
Audit Logs
Track important actions for security, accountability, and compliance workflows.
Why Audit Logs Matter
Audit logs help you answer:
- who performed an action
- what changed
- when it happened
- where it happened (branch/system scope)
Events to Track
At minimum, retain logs for:
- authentication events (login, logout, failed attempts)
- permission or role changes
- branch switching and branch-level administrative actions
- sensitive data updates and deletions
- key license and billing events
In Holy Resource operations, activity logging can appear in multiple domain areas (for example account activity and certain module-level audit events).
Practical Use
Use audit logs to:
- investigate incidents
- validate policy enforcement
- support internal reviews and external audits
Retention and Access
- Restrict who can read audit/activity logs.
- Keep log exports separate from day-to-day user data exports.
- Align retention windows with church policy and local compliance requirements.
Retention Guidance
- Keep retention aligned with your organization policy.
- Ensure logs are tamper-evident and access-controlled.
- Separate operational logs from sensitive payload storage when possible.
Related
- Encryption & sensitive fields: /docs/security/security-model
- Security model: /docs/security/security-model
Last updated on
Was this helpful?