Purpose

ConveYour maintains records appropriate to its AI-enabled features so that material activity, decisions, incidents, and customer concerns can be understood and investigated. The goal is to provide useful evidence without collecting or retaining more personal information than necessary.

Audit trails support accountability. They help answer practical questions such as what happened, when it happened, which feature and configuration were involved, who acted, what information was available, and what ConveYour did in response.

What ConveYour records

The records collected depend on the feature, data sensitivity, and risk. For material AI-enabled workflows, ConveYour may retain:

• The identity or role of the authorized user or system that initiated an action
• The date and time of the relevant event
• The feature, model, provider, prompt version, workflow version, or configuration used
• Relevant system actions, errors, access events, and administrative changes
• Inputs, outputs, or appropriate metadata needed to investigate a concern
• Human review, override, correction, or escalation activity where the product captures it
• Testing records, risk assessments, release approvals, and corrective actions

ConveYour does not treat logging as a reason to retain full customer data indefinitely. Logs should be designed to support security, troubleshooting, and accountability while minimizing unnecessary sensitive content.

Audit-trail design

For a material AI workflow, ConveYour seeks to make it possible to reconstruct the relevant sequence of events. The record should identify the specific version of the workflow and the controls in effect at the time.

When practical, audit records distinguish between:

• Information supplied by a customer or user
• AI-generated output
• Human changes, approvals, overrides, or decisions
• Automated system actions