Licensed to be used in conjunction with basebox, only.
// security
Audit & Logging
Applies to
Product: Demo · Cloud · Server · Audience: Security / Compliance reviewer
What the audit log records (and what it deliberately does not, e.g. the text of web search queries), how retention and detail level are configured, how to export, the notice in the chat when conversation content is recorded – and alongside it the platform's technical logs, which are something different. Two levels, two purposes:
| Audit log (application) | System/application logs (operations) | |
|---|---|---|
| Purpose | Traceability of actions in the organization | Operation, troubleshooting |
| Who sees it | Administrators of the organization, in the interface and via export | Platform Operator (Server) or basebox operations (Cloud) with shell/cluster access |
| Content | Who did what when, with which result | System status, runtime errors, requests |
| Conversation content | Only if the detail level provides for it – then with a notice in the chat | Only at trace level, off by default |
| Retention | Configurable in the application | A matter of the operator's log infrastructure |
The audit log
What is recorded by default
Security-relevant actions – each with timestamp, user, result, affected resource and client address:
- Sign-ins (
user.login) - Changes to users, groups, roles, daily announcements, apps, settings (GraphQL mutations,
graphql:*) - Exports, including the export of the audit log itself (
rest:exportAuditLogs) - Tool calls of connectors and web search: organization, user, tool, provider, result, timestamp – not the text of the query
What is not in the default: conversation content, uploaded files, content of tool results.
Detail level
Administrators can additionally have questions or questions and answers recorded. As soon as that is active, all users see a clear notice in the chat – the transparency cannot be disabled. The audit log thereby becomes the most sensitive table of the installation: keep retention short, limit access to administrators, protect exports. Whether and to what extent this is enabled is a decision with the data protection officer and usually with involvement of the employee representation.
Retention
The retention slider exists under Administration → Organization in the audit log section, but currently has no effect: audit entries are not deleted automatically. Implementation is in progress. Until then all entries are kept. Whoever needs longer evidence exports regularly and is responsible for the export files (Retention). Audit entries cannot be deleted individually.
Export and SIEM
Export as CSV from the administration (Exports) or via the REST API; forwarding to a SIEM per SIEM integration. An export file contains user identifiers, timestamps, client addresses and – depending on the detail level – conversation content: store encrypted, limit recipients, delete once the purpose is fulfilled. Every export is itself in the audit log.
Who sees it
Administrators of the organization. Users do not see their own actions as a log, but they see the notice in the chat when content is recorded. basebox sees an organization's audit log only if it has technical access to the database as platform operator (Cloud) or under an operations contract (Server) – never via the application.
The technical logs
On a server, frontend, AISRV, storesrv, Keycloak, ragsrv, ragsrv-support, inference and the databases produce container logs; they end up in the Platform Operator's log infrastructure (journald, log stack). basebox sets no retention of its own. Controlled via LOG_LEVEL (Logging):
| Level | Contains | Personal data |
|---|---|---|
error, warn |
Errors, warnings | Low (user identifiers possible) |
info (production recommendation) |
Requests, state changes | User identifiers, client addresses |
debug |
Internal flows | Elevated |
trace |
Prompt and response content | Complete conversation content – only for troubleshooting, time-limited, clean up logs afterwards |
User credentials appear at no level in production logs. The chart default for LOG_LEVEL is trace for some services – set to info in production and verify. In the Cloud, basebox is responsible for the technical logs; prompt logging is not active there either.
Per deployment model
- Cloud: audit log entirely in your hands (detail level, retention, export). Technical logs with basebox.
- Server: both with you – audit log with the administrator, technical logs with the Platform Operator. Under operation by basebox: maintenance actions appear in the audit log; basebox sees technical logs in the maintenance access (Remote maintenance).
- Demo: to try out the notice in the chat and the export.
For the review
- Set the detail level deliberately and justify it; the default is "actions only".
- Set retention; document the export process and storage location of exports.
LOG_LEVELin production atinfo; trace only temporarily with clean-up.- Review the audit log regularly: sign-ins, role changes, connector approvals, web search calls, exports.
- The Infrastructure policy (October 2025) still lists the audit export function as "planned"; the CSV export and
rest:exportAuditLogsare available by now.
Next step: Compliance