Every action in the system is recorded, who did what, to which document, and which fields changed. It comes in three layers: a quick per-document history anyone can see, a full audit engine for administrators, and a separate, higher-sensitivity ledger reserved for admin-level operations.
- What is captured on every action
- The per-document history at a glance
- The full audit engine for administrators
- The Privileged Operations ledger for admin-level actions
What is captured
As people work, the system records the trail: the entities they touch, the actions they take (a status change, an edit, a creation), and the field changes themselves, what a value was before and after. Nothing meaningful happens without leaving a record.
The per-document history
On a document, a button (top right) opens its own history: the recent activity on that record, who touched it and what they did, grouped sensibly so it reads as a story rather than a flood. It answers “what has happened to this document?” at a glance, for anyone working on it.
Explorer: the full audit engine
Behind that everyday view sits a complete audit engine, available to a system administrator: a system-wide explorer that can query all activity, filtered by date, user, document type or keyword. Where the per-document history tells one document's story, Explorer is the forensic view of the whole organisation, the source of truth for “who changed this, and when?”.
Privileged Operations: a separate, smaller ledger for admin-level actions
A third surface sits alongside Explorer, reading its own separate record rather than the everyday activity log: the Privileged Operations ledger, reserved specifically for genuinely admin-level actions, entity merges, document overrides, data porting commits, the kind of change that reshapes records rather than just editing one. Each entry carries a full before-and-after snapshot of exactly what changed, shown as a field-by-field comparison, and the ledger itself is append-only, nothing on it is ever edited or removed. Where Explorer answers “what happened across the organisation,” Privileged Operations answers a narrower, higher-stakes question: “what did an administrator just reshape, and what did the record look like on both sides of that change?”
Why three layers
The split matches who needs what, and how much is at stake. Everyday users get the document's own history without ceremony; administrators get the deep, queryable Explorer when a question demands it; and the rarer, higher-consequence admin actions get their own dedicated, tamper-evident ledger rather than being buried in the general activity stream. Same underlying event, different windows sized to the risk.
Good practice
- Check the history when something looks off on a document; the answer is usually in its recent activity.
- Reach for Explorer for anything system-wide or forensic.
- Reach for Privileged Operations specifically to review a merge, an override, or a porting commit, and see exactly what changed on both records.
Related
- Guide: Configuring and administering your Cloudby organisation
- Reference: Document Lifecycle
- Reference: Users and access (who can see the full audit)