The Activity Log

TechieCRM keeps a record of what people do in your workspace: who signed in, who changed which record, who disabled a user, who exported data. This chapter explains what is recorded, who can see it, and how to read and export it on the desktop app, the web portal and the phones.

In this chapter

• What is recorded, and what is not
• Who sees what
• Reading the log on the desktop app
• Reading the log on the web portal
• Reading the log on a phone
• Exporting the log
• What the entries mean
• When the log cannot be written
• Retention, and what can never happen
• Not yet available

What is recorded, and what is not

Four groups of actions are recorded (the current release):

Not recorded: who looked at which record. Viewing is never logged.

Signing in, switching user and closing on the desktop app

The desktop app records three moments under Sign-ins, whether or not the computer is online and whichever way the person signed in (an office login or a TechieCRM ID):

Cancelling the sign-in window, a sign-in that was refused, or signing the same person in again records nothing. If the log table cannot be reached at that moment (the database is down, or the app is closing while the connection is lost), the entry is held on the computer and written later, with (late) in the From column, like any other entry.

Each of these moments, and when the person goes idle (15 minutes with no typing or clicking in TechieCRM) or becomes active again, is also kept in a small list on the computer for the cloud's My Devices page. Idle and active are not Activity Log entries (they are not something a person did). Nothing from this list is sent to the cloud in this release; nothing about what the person looked at or typed is ever kept in it.

Each entry says who did it (the signed-in user), what they did, to which record (its name is kept, so the entry still reads after the record is gone), when (UTC), from where (the desktop app, the web portal, a customer's own portal, an iPhone or an Android phone, with the computer or device), and, for an edit, which fields changed, from what to what.

Sensitive values are never shown. Passwords, bank account and routing numbers, tax and ID numbers (SIN, business number, passport, licence), wages, pay rates and commissions, dates of birth and other private fields show as (hidden): the entry says the field changed, never the value. The text of a note, an email or a document is never copied into the log; the entry says the text changed, nothing more.

Who sees what

• Administrators (the MASTER login, or a user with user-management rights on the desktop; a user with the Admin role on the web portal) see every entry in the workspace, on every surface.
• Everyone else sees their own entries: what they did, nowhere else. Asking for another person's activity is refused.

Every entry is tied to the user who did the action, and is shown under that user's record (the user dialog's Activity tab on the desktop, the Activity card on a user's page on the web). Users are never deleted, only disabled, so the history always has someone to belong to. An administrator's change to a user (say, disabling Bob) is the administrator's entry, not Bob's.

Reading the log on the desktop app

Three ways in:

1. Setup ▸ Administration ▸ Activity Log on the ribbon: the whole workspace's log (an administrator) or your own (anyone else).
2. Your name menu (top right) ▸ My Activity…: your own entries.
3. Administrator ▸ Manage Users ▸ Activity Log… (A4): the selected user's entries; and the Activity tab of the user dialog (right-click a user ▸ Open) shows the same list.

The window:

Columns: When (your local time), Who, Action (with (refused) or (failed) when the attempt did not go through), Record, Details (the description, then one line per changed field, old value then new; (hidden) for a sensitive field), From (the surface and device; (late) when the entry was held on a PC and written later; ALTERED when a row no longer matches its own fingerprint, which should never happen and is worth telling TechieCRM about).

Entries made on the web portal and the phones appear in the same list once the cloud sync has run: the computer that owns the sync copies them into the office's log table.

Reading the log on the web portal

• Your name menu ▸ Activity Log (administrators) or My Activity (everyone else), or open /activity-log/.
• Filters: User (administrators only), Category, Action, Record id, From and To dates (the last 7 days by default; All dates lifts it). Fifty entries a page.
• A user's page (Workspace Admin ▸ Users ▸ open a user) has an Activity card with that user's latest entries and a See all link.
• TechieCRM's own administrators see a workspace's log from TechieCRM Admin ▸ Tenants (the journal button on each row), and a user's entries from that user's page.

Entries made on the desktop app appear on the web once the desktop's cloud sync has run (normally within fifteen minutes).

Reading the log on a phone

The iPhone and Android apps show the log read-only, with the same rule: you see your own entries, an administrator sees everyone's. The phone reads it from the cloud each time the screen opens and never writes to it. (The phone screens follow the cloud release that carries this chapter.)

Exporting the log

An administrator can save the entries matching the current filters as a CSV file: Export CSV… on the desktop window, or Export CSV on the web page. One row per entry, with the changed fields in one column (sensitive values still (hidden)). At most 50,000 rows per export; narrow the dates for more.

The export is itself recorded as an entry under Data leaving the system ("exported the activity log"), with the row count and the filters used.

What the entries mean

Each entry also has a one-sentence summary, the same on every surface, for example:

• Jane Smith edited client Acme Ltd (2 fields changed).
• Jane Smith changed the status of client Acme Ltd (1 field changed): Client status changed on the web.
• Jane Smith disabled user Bob Brown: User disabled (workspace=acme).
• jane@acme.com failed to sign in.
• Jane Smith exported the activity log (312 records): Activity log export to CSV.
• Jane Smith sent a bulk email to 300 records: Subject: Spring news; 300 sent, 12 skipped, 0 failed; from ann@acme.example. This is an Email to Many (Chapter 12, Email to many people, one at a time): one entry per send, written when it finishes or is cancelled (also when it is cancelled after a restart). The count is how many were sent; N not sent and N may have been sent are added when there are any. The message itself and the list of people are never recorded.

An entry whose action was refused (for example a delete that was stopped by the "deleting a client is discouraged" warning, or a user change that could not be recorded) is still in the log, marked (refused): the log shows that someone tried.

When the log cannot be written

• Ordinary changes go through. If the desktop app cannot reach the log table (the connection dropped), your save still happens and the entry is held on your computer, then written as soon as the database is back. Such entries show (late) in the From column. The web portal has no held queue: a lost ordinary entry is reported in the server log.
• Security changes wait. Disabling or enabling a user, changing rights, changing or resetting a password: these are made only when their entry can be recorded. If it cannot, the change is not made and you are told why; try again once the connection is back. The refused attempt is itself recorded.

Retention, and what can never happen

• Entries are kept for ever. There is no delete button, no delete command and no code path that changes or removes an entry, on any surface. The desktop's log table refuses any update or delete; the cloud refuses to change or remove an entry a device pushes.
• An administrator setting to archive entries 7 or more years old (move them out of the live log into an archive the administrator keeps; nothing is deleted) is planned.
• The log is never altered, including for an erasure request.
• The log counts toward a cloud plan's storage.

Not yet available

• The archive setting (entries 7+ years old).
• The phone screens (planned; the cloud side they read from is in place).
• Record edits made on the web portal other than a client's status change and a client's deletion are not yet recorded; the desktop records user disable/enable, sign-ins, switching user and closing (see Signing in, switching user and closing on the desktop app) today, and a failed desktop sign-in is not recorded yet; it gains the rest of its writers module by module. Each chapter says what its module records as those writers land.
• "Who looked at which record" is deliberately not logged.
• Saved logins (the Credential Storage Manager, chapter 31): who saved, opened, copied, shared, removed, rolled back or deleted a login is kept in that login's own History (the owner's Share dialog, and an administrator's for a Business login); recovery requests, approvals and refusals are recorded with the saved logins too. None of them ever holds a password, and none is written to this log yet.