A record of who did what

When someone asks who changed a record, or who looked at a person's right to work evidence, you need an answer you can rely on. This page explains what HRHive records, and how far that record goes.

The facts

What the audit log records

Important activity is recorded in an audit log. Each entry shows who acted, from which device and address, and what changed.

Some views and downloads are recorded too: downloads of documents, views of right to work evidence and bank details, views of cases and most exports.

How entries are protected

The database rejects updates and deletes on audit log entries. This is enforced in the database itself.

Locked records and fingerprints

Signed and completed records are locked, and each stored file carries a SHA-256 fingerprint. A fingerprint is a short code calculated from a file's contents. If the file were changed, its fingerprint would no longer match.

When a document is signed, HRHive records its fingerprint before and after signing, produces a sealed PDF with an audit certificate, and sends every signer a copy.

What it means for you

• When someone asks who changed a record, the audit log shows who acted, from which device and address, and what changed.
• When a reviewer asks who has looked at a person's right to work evidence, those views are recorded.
• A signed document carries its own evidence: its fingerprints, a sealed PDF and an audit certificate.

What we do not claim

• That every view is recorded. The views listed above and most exports are recorded, but not every view is. For example, printing some packs from your browser is not logged.
• More protection than the log has. The database rejects edits and deletions of entries, but the entries are not chained together cryptographically. We describe the log as exactly that, and no more.