The audit log
What LegalBook records, why the log cannot be changed, and searching and exporting it.
For: Owner
The audit log is the firm's record of who did what to which record, when and from where. Every module writes to it. Nothing in LegalBook can change or delete an entry.
What is recorded
- every create, update and delete of firm data,
- every download, share, print and export,
- every approval, decision, transfer and role change,
- every refused attempt on a sensitive record,
- reads by LegalBook staff under break-glass or support access, and cross-firm reads by platform roles,
- setting changes with their reason.
Each entry has the person, the action, the record, the time, the request it came from and, where relevant, the before and after values. Sensitive values are masked for readers who may not see them.
Append-only and hash-chained
Entries are append-only. Each firm's entries form a hash chain: each entry includes a fingerprint of the one before it. LegalBook recomputes every chain daily. If a chain does not verify, a critical security alert is raised and the affected entries are marked as unverified on the audit screen.
Where archive storage is configured, entries older than 13 months are also copied to it each month. They are never deleted from the log.
Search the log
You need audit permission (Firm owner, Firm administrator or Supervising attorney).
- Open Audit log (press g a).
- Filter by person, record, record type, action and time range.
- Open an entry to see its details and before and after values.
Reading the log is itself recorded.
Export
Exporting the log to CSV needs audit and export permission and a recent sign-in, and is limited to a few exports an hour. If the firm requires approval for audit exports, an approved export matching the same filter must exist first. The file ends with a row count and a fingerprint, so a changed file can be detected.