Audit and evidence
Your gateway records every answer, every reveal and share, and every change to its setup, in your cloud. Admins can read all of it from the console or the admin connector. None of it holds the real values of token columns.
What gets recorded
Section titled “What gets recorded”| Log | One entry per | Holds |
|---|---|---|
| Answer records | Query (and each describe, for its sample rows) | Who asked, when, the AI app, the source, the SQL as the AI sent it and as the gateway ran it, the datasets and columns used, which columns were tokens, the definitions in force, the AI’s assumptions, the rows returned, whether they were cut at the row limit, a SHA-256 hash of the result, and the rules version in force |
| Reveals and shares | Click to show, value sent to the AI, or row matched by Find | Who, when, which column, which answer record. Never the value. |
| Setup log | Change to sources, access rules, groups, hosts, reminders, context, definitions and links, and each records export | Who, when, what, and the details of the change |
Each log is hash-chained: every entry’s hash covers the one before. An entry that is edited, deleted or put out of order breaks the chain, and the console’s Overview then says Logs need attention. The gateway keeps running and answering (Troubleshooting).
The records live in the gateway’s records file (on AWS, on the encrypted EFS file system). Portward keeps every entry; there is no setting to expire or delete records. Back them up with the rest of the gateway (Update and back up).
Find an answer
Section titled “Find an answer”In the console, open Records. Answers lists the newest first, 50 at a time (Load more for the next ones). Search the SQL or a record ID, or open More filters for Who asked, Source, Dataset, From (date) and Until (date). Select an answer’s time to open its evidence pack.
People find the record ID in their results table’s footer, “Answer record” followed by 32 letters and digits, and the AI lists the records it relied on at the end of its answer.
The evidence pack
Section titled “The evidence pack”The evidence pack is one answer record with everything around it. It shows:
- SQL as asked, and SQL as run when the gateway changed it to apply the rules
- Who and when: who asked, their directory ID, the AI client, the source, the rows returned, and Access rules, which links to the setup change in force (“As of change 42”)
- Data basis: the datasets, the columns the query names, and the columns sent as tokens
- The AI’s assumptions and the Definitions in force
- Later reveals and shares of this answer’s values
- Proof: the record ID, its position in the answer log, the record hash and the result hash
- whether every log verifies
It doesn’t hold the AI’s reply, which stays in Claude or ChatGPT. Select Download (JSON) to keep a copy.
From chat, ask the admin connector “Show the evidence for answer record” followed by the ID, or “for the last
answer”. The evidence tool opens the same pack in the widget, with Download evidence (JSON).
Export records
Section titled “Export records”On Records, Answers, filter to what you need, then select Export matching (JSON). The file holds up to 10,000 matching records in full, with each one’s position and hash in the chain and whether every log verifies. The export itself is recorded in the setup log, with who exported and which filters.
Reveals and shares
Section titled “Reveals and shares”Records, then Reveals and shares, lists each time someone revealed a value, sent values to the AI or matched a
row with Find: when, who, what, the column and the answer record. From chat, reveal_log gives the latest of these events
(50 by default).
Setup changes
Section titled “Setup changes”Records, then Changes, lists the latest 200 changes to sources, access and settings, numbered by their
position in the log, with who and the details. An evidence pack’s Access rules link opens the change that was in
force. From chat, setup_log gives the latest changes (30 by default), and the governance view’s Recent activity
mixes recent changes with reveals and shares.
Ask the admin connector “Which columns are used most?”. access_summary lists each column with how many queries
used it, how many people, and how often its values were revealed, from the most recent 5,000 answers. The console’s
Overview shows the last 7 days: answers, people and reveals.
Admin console: a tour of each screen.