Append-only audit log. Every backend service that mutates one of your records calls a central `log()` helper that writes a row to the `audit_log` table. The row captures *what* changed (entity type + id), *which field* moved, the old and new values, *when* it happened, and — for actions inside a logged-in session — the source IP and a device hint (e.g. `Chrome · macOS`). Nothing in the application ever deletes from this table; the only mutation is the daily IP-anonymisation cron (see below).
Privacy-by-default rendering. The user-facing list shows the raw IP only inside the 30-day fresh window. After 30 days a daily cron truncates IPv4 to /24 (`5.6.7.0`) and IPv6 to /48 (`2a01:5b8:1234::`). The raw user-agent string never leaves the backend in either the list endpoint or the export — it's parsed server-side into a short `Browser · OS` label and only that label travels over the wire.
DSGVO Art. 15 export. The download button hands you the same payload as the on-screen list, but unpaginated and capped at the most recent 10 000 rows. Filename is stamped with today's date so multiple exports stack in your Downloads folder without overwriting. Format is JSON — easy to feed into a script if you ever need to sift the data outside the dashboard.
- Look here first when something looks off. A trade you don't remember editing? Sort the log by `entity_type=trade` and scan timestamps. A broker sync that ran when you didn't trigger it? Filter `entity_type=broker_connection` and read the device hint — was that you on your phone, or someone else?
- The IP narrows down 'where was I when this happened'. Useful for the trader; useless for an attacker who'd see the same /24 once it's older than 30 days. We trade fresh detail for long-term anonymisation.
- Old data is intentionally fuzzy. A 6-month-old row tells you the action happened, from a Chrome browser, somewhere in /24. That's enough for trust + audit, not enough for surveillance of past behaviour.
- No 'who else has accessed your account' row exists beyond what you do yourself — TradeOnyx engineers never read your trades or journal entries; the audit log records *your* actions and *your* automated jobs, nothing more.
- Export it before you delete the account. The right-of-access is alive while the account is. After deletion the rows go away with everything else (Art. 17). Pull the JSON first if you want a personal archive.
Routine inspection. Open Settings → Datenschutz → Activity log once a week or after any unexpected dashboard surprise. Filter by category (Trades / Journal / Broker credentials / …) to narrow the noise, page through with Prev/Next.
After a security-mail alert. You received a new-device email and want to confirm what happened: open the activity log, look for the matching login row, check the device hint. If it doesn't match your device — revoke the trusted-device row (Settings → Security), change the password, enable 2FA if not already.
DSGVO Art. 15 personal archive. Once a quarter, click *Aktivitäts-Log exportieren*. The JSON file is small (a few hundred KB even for a heavy user) and gives you a permanent off-platform record. Combined with the broader profile data-export above, it's the complete picture of every byte we hold for you.
Investigating a sync surprise. Broker auto-sync pulled a trade you don't remember placing? Filter the log to `Broker-Verbindungen`, find the sync timestamp, then jump to the Trades tab with a matching date filter. The audit log narrows where in the pipeline the data entered; the Trades tab shows what entered.