| When (UTC) | Actor | Action | Entity | Detail |
|---|---|---|---|---|
| 2026-11-0808:23:36 | admin@expensa.app | Export | report #1 | {"format":"receipts_zip","files":0} |
| 2026-11-0808:23:35 | admin@expensa.app | Export | report #2 | {"format":"receipts_zip","files":0} |
| 2026-11-0808:23:34 | admin@expensa.app | Export | report #3 | {"format":"receipts_zip","files":0} |
Secrets never reach this table: your AI provider's API key, OIDC client secrets, SMTP passwords and the backup token are stripped before an entry is written. A subject-data export is recorded as a count and never the name that was searched for — logging who was looked up would create exactly the record the request was about.