Licensed to be used in conjunction with basebox, only.
// security
Audit & Logging
Applies to
Product: Cloud · Server · Audience: Security / Compliance reviewer · Works council
For decision makers
Overview, ISO 27001 and topics for the works council: basebox.ai/en/security. These pages provide the technical evidence.
What the audit log records (and what it deliberately does not, e.g. the text of web search queries), how Audit Log Level and retention are handled, how to export, the notice in the chat when conversation content is recorded – and alongside it the platform's technical logs, which are something different. Two levels, two purposes:
| Audit log (application) | System/application logs (operations) | |
|---|---|---|
| Purpose | Traceability of actions in the organization | Operation, troubleshooting |
| Who sees it | Administrators of the organization, in the interface and via export | Platform Operator (Server) or basebox operations (Cloud) with shell/cluster access |
| Content | Who did what when, with which result | System status, runtime errors, requests |
| Conversation content | Only at level "High" – then with a notice in the chat | Only at trace level, off by default |
| Retention | 6 months; the administrator can set 3–36 months | 7 days; on a server unless you configure otherwise |
The audit log
What is recorded by default
Security-relevant actions – each with timestamp, user, result, affected resource and client address:
- Sign-ins (
user.login) - Changes to users, groups, roles, daily announcements, apps, settings (GraphQL mutations,
graphql:*) - Exports, including the export of the audit log itself (
rest:exportAuditLogs) - Tool calls of connectors and web search: organization, user, tool, provider, result, timestamp – not the text of the query
What is not recorded at level "Standard": conversation content, uploaded files, content of tool results.
Audit Log Level
Administrators set the scope under Administration → Organization → Audit Log Level. There are two levels:
| Level | What is recorded |
|---|---|
| Standard | All sign-ins as well as changes to settings and data within the organization. Recommended setting for normal operation. No chats. |
| High | Additionally the chats, i.e. questions and answers. They are then also stored on the server, not only in the users' browser database. |
As soon as questions or answers are recorded, all users see a notice in the chat; the notice cannot be disabled. At level "High" the audit log becomes the most sensitive table of the installation: limit access to administrators, protect exports. Whether "High" is enabled is a decision with the data protection officer and usually with involvement of the employee representation.
Retention
The audit log is kept for 6 months. The administrator sets the period under Administration → Organization in the Audit Log Level section (audit log retention in months, 3 to 36 months). Whoever needs longer evidence exports regularly and is responsible for the export files (Retention). Audit entries cannot be deleted individually.
Export and SIEM
Export as CSV from the administration (Audit Log); automatic forwarding to a SIEM does not exist today; how to get audit events into a SIEM is described under SIEM connection. An export file contains user identifiers, timestamps, client addresses and – at level "High" – conversation content: store encrypted, limit recipients, delete once the purpose is fulfilled. Every export is itself in the audit log.
Who sees it
Administrators of the organization, under Administration → Audit Log (Audit Log). Users do not see their own actions as a log, but they see the notice in the chat when content is recorded. basebox sees an organization's audit log only if it has technical access to the database as platform operator (Cloud) or under an operations contract (Server) – never via the application.
What is logged about employees
For works councils and data protection officers: the audit log contains personal data of the employees who use basebox.
- Level "Standard": sign-ins as well as changes to settings and data, each with timestamp, user identifier, result and client address. For tool calls of connectors and web search: who used which tool when, not the text of the query. No chats.
- Level "High": additionally the chats, i.e. questions and answers. They are then also stored on the server. In this case all users see a notice in the chat that cannot be disabled.
- Who sees it: only the administrators of the organization, in the interface and via CSV export. Every export is itself in the audit log.
- How long: 6 months; the administrator can set 3 to 36 months.
- Who decides: administrators set the level. The decision for "High" is usually made with the data protection officer and with involvement of the employee representation.
Operation in the interface: Audit Log.
The technical logs
On a server, frontend, AISRV, storesrv, Keycloak, ragsrv, ragsrv-support, inference and the databases produce container logs; they end up in the Platform Operator's log infrastructure (journald, log stack). System logs are deleted after 7 days unless you configure otherwise. Controlled via LOG_LEVEL (Logging):
| Level | Contains | Personal data |
|---|---|---|
error, warn |
Errors, warnings | Low (user identifiers possible) |
info (production recommendation) |
Requests, state changes | User identifiers, client addresses |
debug |
Internal flows | Elevated |
trace |
Prompt and response content | Complete conversation content – only for troubleshooting, time-limited, clean up logs afterwards |
User credentials appear at no level in production logs. The chart default for LOG_LEVEL is trace for some services – set to info in production and verify. In the Cloud, basebox is responsible for the technical logs; prompt logging is not active there either. basebox deletes system logs in the Cloud after 7 days; questions, answers and documents are not in them.
Per deployment model
- Cloud: audit log with you (Audit Log Level, retention period, export). Technical logs with basebox, deleted after 7 days.
- Server: both with you – audit log with the administrator, technical logs with the Platform Operator. Under operation by basebox: maintenance actions appear in the audit log; basebox sees technical logs in the maintenance access (Remote maintenance).
For the review
- Set the Audit Log Level deliberately and justify it; "Standard" is recommended for normal operation.
- Set the audit log retention period (default 6 months, adjustable from 3 to 36 months); document the export process and storage location of exports.
LOG_LEVELin production atinfo; trace only temporarily with clean-up.- Review the audit log regularly: sign-ins, role changes, connector approvals, web search calls, exports.
- The Infrastructure policy (October 2025) still lists the audit export function as "planned"; the CSV export and
rest:exportAuditLogsare available by now.
Next step: Audit Log in the administration · Compliance