Delphi Pronoia · MetodixBeta
Sign in

Logging policy

Delphi Pronoia records every act that opens a study's data to someone or changes what may be done in a study. This page states what is recorded, what is not, who sees the log, and what the log cannot prove.

What is recorded

  • Rights: team members and roles, invitations, transfer of ownership, attaching to an organisation, takeover, and a service administrator opening and closing support mode, with the reason.
  • Anonymity: turning blinding on and off (turning it off is possible only before any human has been invited), changing the link mode, one-time display of a panelist's link with the reason, and a facilitator writing through a human panelist's link.
  • Answers: an answer entered on behalf of an AI panelist, resetting answers (owner only; human answers only in a test copy) and discarding a round's answers during a thesis import (human answers only in a test copy).
  • Method: exceptions to rounds and phases, changes to the instrument and closing the study.
  • Data protection: changes to the consent text and the controller's declaration, and a panelist's withdrawal.
  • Administration: acceptance of the service administrator's commitment (version and time) and platform user management.

What is not recorded

  • Log entries do not contain panelists' answers, rationales or comments.
  • Log entries do not contain panelists' names or e-mail addresses; a panelist is referred to by code.
  • The event log does not record IP addresses.
  • Reading by study team members is not recorded: a team member is entitled to see what their role allows. Access from outside the team arises only through a recorded act (invitation, support mode, takeover).

Who sees the log

  • The study owner sees the study's full log, including who received which role.
  • A facilitator sees the study's events but not entries that name a person and their rights.
  • A viewer does not see the log.
  • An organisation's administrator and manager see the organisation's log. Opening support mode appears in both the study's and the organisation's log.
  • A service administrator sees the platform administration log.

Immutability and retention

  • The application has no function for editing or deleting a log entry.
  • Log entries are kept even if the study, the panelist or the user account is deleted.
  • The log is included in the service's backups like the rest of the database.

Access outside the application

  • The server's technical administrators can read the database and backups outside the application. This cannot be prevented in code, so it is agreed: every administrator has accepted the commitment below.
  • Under the commitment, every direct use of the production database or backups is recorded in the maintenance log on the same day (date, person, reason, what data). A study's controller can ask Metodix for an extract of the entries concerning their study.
  • Panelists' personal links are not stored in readable form in the database, only as hashes. A link can be reconstructed only with the server key, which is not in the database or in the backups.

What the log does not prove

The log is not cryptographically signed. An entry cannot be changed from the application, but someone with direct database access could. That is why direct access rests on the commitment and the maintenance log.
The log records the act, not the intent. The reason for support mode is the administrator's own entry.

Service administrator's commitment

Every service administrator accepts this text in the application, and the acceptance is recorded. Without a valid acceptance an administrator cannot open support mode.