Logging data

The ClauseBase platform stores log-data for four different purposes:

  • Security, e.g. to detect attacks by malicious actors and availability, e.g. to detect whether servers would reach capacity limitations. ClauseBase is ISO 27001 certified, and central logging is an important requirement under this certification scheme. Similarly, the logs also allow to detect abuse, e.g. to trace whether customers would store illegal information.

  • Provide support to users, e.g. to investigate why something does not seem to work.

  • Invoicing and usage limitations, e.g. to track the number of translations and LLM requests submitted by customers, and to track the number of DOCX/PDF documents exported by customers (e.g., to invoice customers who are licensing the platform on a per-export basis)

  • Customer usage, e.g. to check which features are popular and which customers are actively using the platform

Location

Log data is either stored locally on the relevant server (e.g., in Germany, for enterprise customers), or centrally on our central logging server in Amsterdam.

Inspections

The centralised log data is frequently inspected by the ClauseBase team, through a variety of dashboards, such as the one below.

Only metadata

Care is taken that the logs, in general, only contain metadata. In the few instances where it is relevant from a logging/security perspective to store non-metadata, that data is encrypted by the ClauseBase platform instance before being inserted into the log file.

A sample event looks as follows:

Data being logged

Central logs for server requests

Every time the user performs an action at the server (e.g., opening a Clause9 Q&A, storing a clause in ClauseBuddy, redrafting text using ClauseBuddy's AI features, etc.), this event gets logged in the central log. These central logs are kept for 18 months.

Temporary logs

Important internal API events

During a period of 1 month, the full content of the most important events (+ user ID and timestamp) are being logged into a temporary log at each server:

  • Updates to files and folders

  • Updates to documents and Q&As

  • Clauses sent to curators

  • Updates to user account details

  • Opening of anonymous links

Each night, the logs older than one month are being deleted.

Platform usage

During one month, the mere fact that a user is using the ClauseBase platform gets logged into a separate table of the secondary PostgreSQL database of each instance.

Each night, the logs older than one month are being deleted.

In each platform instance's secondary PostgreSQL database, logs are kept for invoicing purposes, as explained elsewhere.

These logs are kept for 7 years, i.e. the term under Belgian law during which invoices can be contested.

Crash logs

When an internal API event crashes or generators an error, an email with relevant details gets sent to ClauseBase developer team, for analysis.

Last updated