Separately from the audit log, MyZapp records every access to sensitive data: who opened a record, downloaded a file or exported the result of a query, when, and through which channel. This log cannot be erased from the application.
Access log
The Sensitive data access screen is in the menu Administration › Instance and operations › Audit. By default it is reserved for Administrators; its permission is separate from the other logs, so that it can be given to a data protection officer or an auditor without opening the rest.
Each row gives the Date, the Category of the data (for example file for a file, query for a query export), the Data (its type and identifier), the Data subject when known, the Access (Read, Download, Export, Create, Update, Delete, Break-glass), the Channel (Screen, API, Scheduled job, Assistant), the Read point (the screen or function used) and the Author. An access made by an automatic task has System as its author.
Filter by category, data type, identifier, data subject, author, access or channel, then confirm; Clear removes the filters. The list is paginated.
Only opening a record is traced, not displaying a list. A file download and a query export are always traced.
Who accessed a record
A module can show, on the record of sensitive data, the Who accessed this record panel: the latest accesses to this record, with the date, the access, the channel and the author. It is only shown to people allowed to open the access log.
Access to my data
When the administrator has enabled it, each person sees an Access to my data tab in their profile: the accesses to data about them. By default, they see the function (groups) and organization of the person who accessed it, not their name; the administrator can choose to show the name. When disabled, the tab does not appear.
Settings
These settings are set in the instance configuration (appsettings file or environment variables), not from a screen.
| Setting | Effect |
|---|---|
Audit:SensitiveAccess:SubjectCanRead |
true: each person sees the accesses to their data (profile tab). Disabled by default. |
Audit:SensitiveAccess:SubjectSeesAgentName |
true: the data subject also sees the name of who accessed it. Disabled by default. |
Audit:SensitiveAccess:StrictCategories |
categories for which an access is refused if the log cannot record it. Empty by default. |
For a strict category, data is never returned without a trace: if the log is unavailable, the screen or API answers that the service is temporarily unavailable.
See also
- "Viewing the logs": audit log, login attempts, email deliveries and application logs.
- "Setting permissions": who to give the access log to.