Contents

Audit trail and record keeping

Audit trail and record keeping

Short answer: hivi-x keeps a server-side audit log of access to client data for seven years, an event trail for every e-signature request, and a sharing history on the client's side. Day to day, you see a file's history on the client's activity timeline.

The audit log

Recorded on the server, not in the browser, so it can't be skipped by the app. It covers actions such as:

  • viewing a client, a checklist or a document
  • downloading a file or a PDF report
  • a client uploading or removing a file
  • sharing and unsharing a checklist, approving an item or sending it back
  • co-agent invitations and access
  • guest-link activity: link created, code sent, verified, session started
  • sign-ins, sign-in failures, passkeys and sign-outs

Each record holds when, which account, from which IP address, what action, on what, and success or failure. It stores identifiers, not document contents or details such as names.

Retention: seven years, after which records are deleted automatically.

Changes: the app only adds audit records and has no feature to edit or delete them. They aren't on write-once storage or hash-chained, so this protects against changes through hivi-x, not against someone with direct database access.

Access: the workspace owner and admins can view and export their firm's part of the log in Account → Activity log. See Team activity log.

E-signature evidence

Every signature request keeps an event trail (sent, viewed, signed, declined, voided, completed) and, when finished, produces:

  • a hash-locked PDF, whose SHA-256 fingerprint is recorded and can be checked by anyone at my-id.ca/verify;
  • a certificate of completion: who signed, when, and how they were verified.

The client's side

Clients with a my-id.ca account have a Sharing History listing each form they sent to a business, with the date and the business's details.

Limits

  • The activity log export covers your workspace. It doesn't include a team member's personal notes, calendar or chat.
  • Timeline and audit log record events, not file versions. A replaced or removed client upload isn't kept as an earlier version.

Related

Answers are general operational information only — not legal, tax, regulatory, clinical, privacy, immigration, or professional advice. Requirements vary by matter, client, and regulator.

Frequently asked questions

Does hivi-x keep an audit log?
Yes. hivi-x logs access to client data on the server, including viewing a client, downloading a file, a client uploading a document, sharing a checklist, approving or sending back an item, and sign-ins. Each record has a time, account, action and result. Audit records are kept for seven years.
Can I export the audit log for my account?
Yes. The workspace owner or an admin opens Account → Activity log, picks dates and chooses Export CSV, up to a year per export. It covers what the team did in the workspace, clients' actions on your checklists and secure links, and sign-ins. Each client page also has its own timeline.
What's in an audit record?
When it happened, which account did it and from which IP address, what the action was, what it applied to, and whether it succeeded. Records hold identifiers, not the contents of client documents or details such as names.
Can audit records be edited or deleted?
Not through hivi-x. The app only adds audit records. It has no feature to edit or delete one, and the only deletion is the automatic cleanup after seven years. The records aren't on write-once storage or chained with cryptographic hashes, so someone with direct access to the database could still change them. To prove a signed document is unchanged, use its hash at my-id.ca/verify.
How do I prove a document was signed and unchanged?
Each completed e-signature request produces a certificate of completion and a hash-locked PDF. Anyone can upload the PDF at my-id.ca/verify to confirm it hasn't changed since signing.

Organize client document intake with checklists

hivi-x helps Ontario professionals collect client documents with reusable checklists, secure Canadian hosting, and exportable PDF packages.

Audit Trail and Record Retention | hivi-x Docs