Help › Security and privacy

The access log

Owners and Admins can review a detailed access log (your name ▾ › Access log): every sign-in and sign-out, every view of a person's record and of the payment and review pages, every report run, every download and upload, every AI call (how many items, never what), and every refused attempt.

• Each row: when, who, their role, the IP address and network, the country estimated from the IP address, the browser and device, and counts such as rows exported.
• Filters: user, action, outcome, dates, IP. Export CSV.
• Alerts: a new device, a sign-in from a new country, many failed sign-ins, large exports outside working hours. Owners and Admins get an email for a new device and for a new country (each can turn either off under Account › Recent sign-ins and devices).
• When our support looks at your organization's figures, the log says "ePayRecon support viewed …".
• Tamper-evident: each row carries a hash of the one before it; the chain is verified daily.
• Kept 1 year by default; an Owner can choose 90 days, 1, 3 or 7 years.

The country of a sign-in

The country is estimated from the IP address with an offline database on our own server, so no outside service is asked. A VPN, a company network or a mobile carrier can place someone in another country; travel explains most "new country" alerts. The first sign-in with a known country is the starting point; after that, each country not seen before for that person raises one alert. The country is kept in the access log only, with the same retention, and never shared.

Country data: IP Geolocation by DB-IP, under the Creative Commons Attribution 4.0 licence. It is refreshed monthly.

Everyone can see their own recent sign-ins and devices under Account, and sign out of all other sessions.