The audit log: what was done, by whom and when
Short answer
The audit log saves every action – for example that a use has been confirmed, a case decided or a rule changed – in plain English. Each entry has a fingerprint built on the previous one (a hash chain), so a later change can be seen: the page shows whether the log is intact. From 18 October 2026, the log stores only IDs and codes, no names. Older entries may contain the names of users, datasets, columns and AI connections and cannot be corrected, because that would break the chain. The log gets independent timestamps.
This is the real system with fictitious data. Try the walkthroughs in the articles to click through.
The audit log is your proof for the regulator and the auditor. You find it under AI use (the item "Everything is saved as proof") and under People decisions.
What does it say?
Each entry shows what happened, when and with which fingerprint. The entries are written in plain English, for example "The use 'Assessment of applicants' has been confirmed". Names of people in your data, your secret words and real values are never in the log.
From 18 October 2026, the log stores only IDs, fixed codes, numbers and amounts – for example the random ID of the user and the dataset instead of the name. The page shows the name of the dataset for as long as the dataset exists. For users, it shows the role, not the name.
Why can older entries contain names?
Entries from before 18 October 2026 may contain the names of users (in payments), datasets, columns and AI connections, as well as error messages. That is how the log was written at the time.
Those entries cannot be corrected or deleted one by one. Each entry is part of the hash chain, so a change would break the chain and destroy the proof for all later entries. They are deleted together with the company's other data when the agreement ends or when you delete everything. If a person has asked for their data to be deleted, write to contact@goalcube.eu.
The hash chain
Each entry gets a fingerprint (SHA-256) that is also built on the previous entry. If an old entry is changed, the chain no longer fits together and the page shows "Broken". If it says "Intact", nothing has been changed.
Timestamps
After every confirmation and decision, the fingerprint of the log is sent to an independent timestamp service (RFC 3161). That way you can show a third party what the log looked like at a given moment. GoalCube currently uses a free service (FreeTSA), which is not qualified under eIDAS.
How long is the log kept?
At least 6 months, as the AI Act requires for logs from high-risk AI (Art. 26(6)). The AI can show the log with vis_log, but can never change it.
Screens recorded from GoalCube 0.26.0 on 22 October 2026 with fictitious data.