The audit trail

Celeus keeps two different records of what happened. They answer different questions, and they are kept in different places.

In short

• The workspace activity trail records who in a workspace did what, when, and with what outcome. It never contains data values.
• The run’s audit log records the steps of one analysis, including each prompt sent to the AI. It travels inside that run’s reproducible package.
• The activity trail is tamper-evident: each entry is linked to the one before it by a cryptographic hash, so a changed, reordered or deleted entry shows up when the trail is verified.
• Within a workspace, only owners and admins have access to its activity trail.

Two records

The workspace activity trail is about people and actions across the whole workspace: who uploaded a dataset, who de-identified it, who started an analysis. It is kept by Celeus for the workspace, one trail per workspace.

The run’s audit log is about one analysis: which dataset it read, which method ran with which seed, and what was sent to the AI. It is part of the run’s reproducible package, so it goes wherever you take the package.

What the activity trail records

Each entry records:

• when it happened
• the workspace and the person who acted
• the action
• the item it concerned, such as a dataset or an analysis, by its identifier
• the outcome, such as whether the action succeeded or was refused

Entries are written for actions such as uploading, reading, preparing and de-identifying a dataset, downloading a linkage key, recording that a flagged column is not an identifier, choosing Not now on de-identification, asking the AI for help and submitting an analysis. Turning on identified-data storage is recorded too, with who made the choice and when.

Entries are written on a best-effort basis; a failure to write one is logged and does not stop the action.

The trail records names of actions and identifiers of items, never the values in your data.

Why it is tamper-evident

Each entry carries a cryptographic hash of its own content together with the hash of the entry before it, so the entries form a chain. Changing an entry, reordering entries or deleting one breaks the chain, and that shows up when the trail is verified.

Tamper-evident means a change can be detected, not that a change is impossible.

Who can see it

A workspace’s activity trail is kept separately from every other workspace’s. Within the workspace, only owners and admins have access to it, and they can request a verification of the whole trail through the API; verification requests are limited in how often they can be made. Members and viewers do not have access. There is no page for the activity trail in the app at the moment.

The run’s audit log

Every run’s reproducible package includes an audit log of that run: reading the data, building the de-identified profile, the method recommendation, the assumption checks and the analysis itself with its seed, and each prompt sent to the AI. An AI step that was not requested is recorded as not requested. See The reproducible package for what else the package contains, and Determinism and reproducibility for how the package lets a result be produced again.

Terms used on this page are defined in the glossary.