What is an activity log for?
An activity log answers questions after something happens. Who changed that approval? When did a file get downloaded? Who gave this person admin rights? Without a log, you rely on memory and guesses. With one, you can check the facts.
A log serves three purposes: security (spotting misuse), accountability (showing who did what) and audit (proving that controls worked).
What should each entry contain?
Every entry should answer the same questions.
| Field | Question it answers |
|---|---|
| Who | Which user or account acted? |
| What | What action was taken? |
| Which record | What was it done to? |
| When | Date and time, with a time zone |
| Result | Did it succeed or fail? |
| Where from | Device or network detail, where appropriate |
| Change | What changed, where relevant, such as old role and new role |
Use a consistent format. Keep the names of actions plain, such as “role changed” and “document downloaded”.
Which events should you record?
Choose by risk. A sensible starting set:
- Sign-in and sign-out, including failed attempts.
- Permission and role changes. Who gave or removed access.
- Uploads and downloads of documents, especially sensitive ones.
- Approvals and rejections of payments, purchases and other decisions.
- Edits to key records, such as budgets, vendors, bank details and staff pay.
- Deletions of records.
- Exports of data in bulk.
- Changes to settings, such as security options and plan changes.
- Access by outside reviewers, such as auditors and donors.
What should you avoid logging?
- Passwords and secrets. Never write them to a log.
- Full personal or case content. Log that a record was opened, not its sensitive text.
- Noise. Constant automatic events hide the ones that matter.
A log that is full of unnecessary detail is harder to read and creates its own privacy risk. Our guide to data protection basics for NGOs explains why holding less data is safer.
How do you protect the log itself?
A log is evidence only if it can be trusted.
- Limit who can read it. Treat it as sensitive.
- Prevent edits. Ordinary users and administrators should not be able to change or delete entries.
- Use accurate time. Entries should carry a reliable timestamp.
- Back it up. Keep a copy where one failure cannot erase it.
- Review it. A log nobody reads protects nothing. Set a routine, such as a monthly look at permission changes and exports.
How long should you keep logs?
Decide a period and write it in your retention schedule. Too short and you cannot investigate old problems or answer an audit. Too long and you hold data you do not need. Check legal rules and donor agreements, and see how long an NGO should keep its documents. Also be open with staff about what you log and why.
A short example
A manager notices that a vendor’s bank details changed last week. She opens the log. It shows that on a Tuesday afternoon one finance user edited the vendor record, with the old and new account details noted as a change, and that a second user approved it the next morning. Both names and times are there. She confirms with both people and finds the change was genuine, a vendor who had moved banks.
If the log had shown a change by a user who should not have access, or at night, she would have started a security check. Either way, she has facts to work from in minutes, not guesses.
Remember that a log answers only the questions it was built for. Before you rely on one, list the questions you expect to ask, such as who changed this, who downloaded that and who gave access, and check that the log can answer each.
Where EMPOBase fits
EMPOBase keeps activity and audit logs of selected product actions, such as sign-in, upload, plan change, role change and document download. It also provides an Export Audit Trail with CSV downloads of recorded export activity, subject to features, permissions and retention. These logs are not a complete record of every action, and not every read is logged, so do not assume full coverage. Outside reviewers using External Access are logged too. See the security page for what is claimed, or contact us with questions.