Sign-in and session activity
Signing in creates a session, and the sign-in system keeps a record of when you signed in and when your session was last active. Once a week an automated report is emailed covering HR administrators and managers only: how many days each was active in the past seven, and when they were last on. Staff accounts are not in that report. How long anyone spends on the portal is not measured, because it is not recorded.
Who can see it: A weekly summary goes to the portal owner. Nobody can look it up inside the portal — the underlying figures can only be read by the scheduled job that sends that email.
Who opened a confidential HR record
Opening a discipline case, HR notes, a personnel file, payroll details, an uploaded document or compliance evidence — or running an export — writes a line saying who opened it, whose record it was, which kind of record, and when. For the most sensitive of these the recording happens before the file is shown, and if it cannot be recorded the file is not shown at all. This exists to protect the person whose file it is: when somebody asks who has been in their record, there is an answer.
Who can see it: HR administrators.
Email the portal sends
When the portal emails you, the mail service reports back what happened to that message — delivered, delayed, bounced, opened, a link clicked, or marked as spam — and the portal stores those events with the recipient address, the subject and the time. This is delivery tracking for portal email only. It says nothing about your mailbox, and the portal cannot see any other email you send or receive.
Who can see it: HR administrators. Contract delivery status is also visible to the HR administrators who hold the contracts permission.
Electronic signatures
When you sign something electronically — an employment contract, a policy or agreement acknowledgement, a compliance form, an onboarding checklist item, a performance review — the portal stores your typed name, the drawn signature if you drew one, the exact wording you signed, the time, your IP address, and the browser and device string your browser sends. The IP address and device are what make a typed name into evidence that it was signed here, by you, at that moment.
Who can see it: You, your manager, and HR — the same people who can see the signed document itself.
Every change to a record
Every insert, edit and deletion writes an audit row: who did it, what kind of change, which record, and when. Changes made by the nightly job, by the mail service, or through a contract-signing link are recorded as System, because no person made them. For an edit, the audit row lists the names of the fields that changed — not their contents. Two deliberate exceptions: HR notes, discipline cases, performance reviews, review scores, accommodation requests and supervisor assignments keep a full copy of the record as it was before it was edited or deleted, so an HR record cannot be quietly rewritten or erased; and on an employee record, changes to role, status, manager, the approval and access permissions, grievance role and end date keep the old and new value. Everything else keeps the field name only.
Who can see it: HR administrators.
When a page breaks
If a page fails, an automatic diagnostic report goes to the error-monitoring service the portal uses, so the fault can be found and fixed. It carries the technical detail of the failure — which page, which browser, what went wrong — not the contents of anyone's record.
Who can see it: The people who maintain the portal.