Audit log

Settings › Audit log lists what has happened in your account: files uploaded, transfers sent and accepted, devices added, members changed, and so on. It is the place to look when something seems off.

Signed and server entries #

Each entry is marked either Signed or Server.

• Signed entries were created and signed by one of your devices when you did something. The server stores them but cannot forge or alter them.
• Server entries record things the server did or observed on its own, such as a guest downloading a file.

Entries are sealed into chained epochs within about an hour. Each epoch links to the previous one, so removing or changing an entry after the fact would break the chain.

Security detailsWhat is this?

• A signed entry carries a hybrid signature (Ed25519 + ML-DSA-65) made by your device's signing key, sent along with the action and stored in the same database transaction, so an action cannot land without its entry.
• Guest actions are signed with a throw-away key made in the guest's browser; actions the server performs itself carry no signature.
• Entries are plaintext metadata: who did what to which object and when. They never contain file contents, names or messages.
• Every hour, entries are sealed into an epoch: a hash tree whose root includes the previous epoch's hash, re-verified continuously. Logs are kept per account, per group and for the system as a whole.

Finding entries #

Filter by Kind: transfers, requests and mail; files; chat; account and security; groups and organisations. Filter by Period: all time, today, last 7 days or last 30 days.

Security alerts #

Events that deserve your attention, such as a new device approval or a PIN lockout, also appear under Security alerts on your dashboard and, depending on your notification settings, by email.