# Audit log

A tamper-evident record of what happened in your account, signed by your own devices.

**Settings › Audit log** lists what has happened in your account: files uploaded, transfers sent and accepted, devices added, members changed, and so on. It is the place to look when something seems off.

## Signed and server entries

Each entry is marked either **Signed** or **Server**.

- **Signed** entries were created and signed by one of your devices when you did something. The server stores them but cannot forge or alter them.
- **Server** entries record things the server did or observed on its own, such as a guest downloading a file.

Entries are sealed into chained **epochs** within about an hour. Each epoch links to the previous one, so removing or changing an entry after the fact would break the chain.

> **Security details**
>
> - A signed entry carries a hybrid signature (Ed25519 + ML-DSA-65) made by your device's signing key, sent along with the action and stored in the same database transaction, so an action cannot land without its entry.
> - Guest actions are signed with a throw-away key made in the guest's browser; actions the server performs itself carry no signature.
> - Entries are plaintext metadata: who did what to which object and when. They never contain file contents, names or messages.
> - Every hour, entries are sealed into an epoch: a hash tree whose root includes the previous epoch's hash, re-verified continuously. Logs are kept per account, per group and for the system as a whole.

## Finding entries

Filter by **Kind**: transfers, requests and mail; files; chat; account and security; groups and organisations. Filter by **Period**: all time, today, last 7 days or last 30 days.

## Security alerts

Events that deserve your attention, such as a new device approval or a PIN lockout, also appear under **Security alerts** on your dashboard and, depending on your [notification settings](https://databeamer.eu/en/docs/account/settings), by email.