Every open, every download, every invite — on the record.

Every stage of a report's life is on the record, from the moment checks finish to the moment the report itself is deleted at the end of its retention window.

• REPORT_READY — All checks completed and the report was compiled. Captures which package ran and when it became available.
• REPORT_VIEWED — Someone on the account opened the report. Captures who, and which report.
• REPORT_DOWNLOADED — The report was saved as a PDF. Captures who downloaded it and when.
• REPORT_SHARED — An expiring link was created to share the report outside the dashboard. Captures who created the link.
• REPORT_LINK_EXPIRED — A shared link reached the end of its life. Captures which link, and when it stopped working.
• RETENTION_DELETED — The report was deleted at the end of its retention window. The report is gone; the record that it existed is not.

Why it matters: if a report is ever questioned, you can show exactly who saw it, when, and how it left the dashboard — even after the report itself is gone.

The applicant's side of the process is logged with the same rigor as the landlord's — proof that every applicant went through the same steps.

• INVITE_SENT — A screening invite was sent to an applicant. Captures who sent it, the unit, and who pays.
• INVITE_OPENED — The applicant opened the invite link. Captures when.
• APPLICANT_CONSENTED — The applicant reviewed the disclosures and agreed to the checks. Captures which disclosures were shown.
• IDENTITY_VERIFIED — Photo ID was matched to a live facial scan. Captures the result, not the biometric scan itself.
• IDENTITY_FAILED — The identity check did not pass. Captures the reason, without exposing the applicant's raw scan.
• ADVERSE_ACTION_NOTICE_SENT — The required notice was sent after a landlord declined an applicant. Captures when, and against which report.

Why it matters: you can prove, applicant by applicant, that consent was captured and the same process ran every time — the record a tribunal or human-rights complaint will ask for.

Every change to who can see what inside your account is written down — useful the day someone leaves, and useful for showing who had access on any given day.

• USER_INVITED — Someone was invited to join the account. Captures who invited them and what role.
• USER_REMOVED — A user's access was revoked. Captures who removed them and when.
• ROLE_CHANGED — A user's role or permissions changed. Captures the role before and after.
• PAYER_CHANGED — The payer on an invite switched between landlord and applicant. Captures who made the change.

Why it matters: when someone leaves the team, you can show exactly when their access ended, and confirm nothing happened on the account afterward.

Sign-ins, failed attempts and anything touching the ledger's own sensitive detail are logged — including access to the forensic detail the ledger otherwise keeps separate.

• LOGIN_SUCCESS — A user signed in. Captures the account and time.
• LOGIN_2FA_CHALLENGED — A sign-in triggered a two-factor challenge. Captures why it was triggered.
• LOGIN_FAILED — A sign-in attempt failed. Captures the account targeted, not the password attempted.
• FORENSIC_DETAIL_ACCESSED — Origin or device detail behind an entry was released. Captures who requested it and the reason given.
• LEDGER_EXPORTED — The ledger, or a filtered slice, was exported. Captures who exported it, and whether it was allowed.

Why it matters: a failed sign-in, a forensic lookup, an export — the events most likely to matter in an investigation are the ones most carefully logged.

The ledger is built to answer regulators and tribunals, not just internal curiosity — kept longer than the reports it describes, and impossible to edit after the fact.

• RETENTION_DELETED — A report was deleted at the end of its retention window. Captures that it existed, and who interacted with it.
• LEDGER_EXPORTED — The ledger was exported for a filing, audit or legal request. Captures who, when, and the scope exported.
• FORENSIC_DETAIL_ACCESSED — Origin and device detail was released for a stated reason. Captures the reason, so a broad request can't be made quietly.

Why it matters: you can hand a regulator or tribunal the relevant slice of the ledger — and the fact that you exported it, and why anyone looked closer, is on the record too.