Security log
The security log is a separate record of every conversation in askTheodor, kept for audits. It lives outside the database, so deleting a chat or emptying the Trash doesn’t remove it. It’s encrypted with this machine’s key and hash-chained. 🛡 Verify proves that nothing was edited, removed or reordered.
How to get here
Open Settings → Workspace → 🔐 Security log.
What’s recorded
| Filter | What it contains |
|---|---|
| 💬 Chats | Every chat message: you and your workers, workers and their tools, and delegated runs. |
| 📡 Channels (WhatsApp, e-mail…) | WhatsApp, e-mail, Signal and Telegram messages, in and out. This includes phone console commands and answers, and secretary requests. |
| 🧾 Audit trail | Approvals, Plan decisions and configuration changes. |
What isn’t recorded: the log records what askTheodor stores. Chats you keep private are never stored, so they’re never logged. That includes other people’s messages to a WhatsApp number in 🔒 Private mode (see Channels).
When a message is recorded
A worker’s reply is saved many times while it streams. So the log waits until a message has settled, which takes about 5 minutes after its last change. Then it records the message once, complete. A new message shows up in the log after a few minutes, not instantly.
Encryption and the hash chain
- Encrypted. Each entry is encrypted with this machine’s own key. It’s the same key that protects your provider API keys (see Security & privacy). The log files can’t be read on their own.
- Hash-chained. Every entry carries a SHA-256 hash of the entry before it. If an entry is edited, removed or moved, the chain breaks.
- 🛡 Verify recalculates the whole chain. If it’s intact, you see how many entries and day files it checked, and “chain intact”. If not, it names the first broken entry (the file and line) and says whether that entry was edited or an entry before it is missing or changed.
Search and filter
Use the row above the list:
- the type filter: Everything, 💬 Chats, 📡 Channels (WhatsApp, e-mail…) or 🧾 Audit trail;
- a from and to day;
- Search text, number, worker…, then Search (or press Enter).
Results show newest first, up to 300 at a time. Click an entry to see everything it recorded.
Export for an auditor
⬇ Export writes a decrypted copy of the selected days to your workspace and opens it. The file
lands in exports/, named security-log_<from>_<to>.jsonl. With no days selected, it exports
everything. Treat the export like the conversations it contains: it’s plain text.
Retention
Keep for sets how long day files are kept: 90 days, 6 months, 1 year (the default), 2 years, 5 years or forever. Older day files are deleted automatically. After old files are removed, Verify checks the chain from the oldest remaining file.
Record conversations turns logging on or off. It’s on by default.
Where the files live
One file per day, in <app data>/security-log/, named YYYY-MM-DD.jsonl. The folder sits next to your
workspace, not inside it. Every machine keeps its own log, including a VPS runner.
In practice
Run Verify before you export. An auditor will want to know the record is complete. A green Verify result followed by an export of the same days is the clean way to hand it over.
Choose retention on purpose. Longer retention helps with audits but keeps more personal data. Pick the shortest period your obligations allow.
Deleting in the app doesn’t delete here. That’s the point of the log. Retention is how you limit how long it keeps things.
🎓 Learn it hands-on: Keep an audit trail
Terms in this page
- Security log: a separate, append-only record of every conversation, kept outside the database.
- Append-only: new entries are only ever added at the end. Nothing is changed in place.
- Hash chain: each entry stores a fingerprint (SHA-256) of the entry before it, so any change breaks the chain.
- Verify: recalculates the chain and points at the first broken entry, if there is one.
- Settled: a message that hasn’t changed for about 5 minutes. Only settled messages are logged.
- Retention: how long day files are kept before they’re deleted automatically.
- Export: a decrypted copy of the selected days, for an auditor.
- Machine key: the key on this computer that encrypts the log and your provider API keys.