Back to Learn

Aptabit Platformv3.7

Administration

Governance and compliance

Unified log, audit trail, provenance, information quality, retention, and LGPD.

On this page

The Aptabit Platform records what happens in the installation and where each AI answer comes from, so your organization can demonstrate traceability, information quality, and control over its data.

Unified log

In Settings > Logs, a single log brings together:

  • every chat, agent, and flow interaction, with content, model, workspace, person, tokens, latency, and rating;
  • the installation's audit events.

The log can be filtered by person, workspace, model, source, event, severity, text, and period. The same tab shows usage per person: conversations, messages, input and output tokens, ratings, files, storage, flows, runs, and agents.

Audit trail

The trail lives in PostgreSQL and records organization, workspace, person, session, source IP, resource, severity, and metadata. Audited events include:

  • sign-ins, failed sign-ins, and sign-outs;
  • changes to people, workspaces, SSO, and sign-in mode;
  • changes to secrets and providers, with before and after values for sensitive settings;
  • license installation, root account lockout and recovery;
  • data queries and loads;
  • deletion of documents, conversations, contexts, and tables, with what was deleted and by whom;
  • changes to retention and telemetry export.

Audit events are not erased by retention purges and cannot be edited or deleted through the API. The database does not enforce technical immutability; restrict administrative access to PostgreSQL according to your organization's policy.

Answer provenance

  • Each chat answer keeps the model that produced it and the sources that grounded it: documents with scores, or the SQL with the number of rows.
  • The chat inspector shows the exact request sent to the model.
  • Each flow run keeps the trace of every block, from input to output.

In Settings > Governance, two indicators track coverage: the share of answers with recorded sources and the share of documents with semantic indexing.

Information quality

The capabilities in this section are aligned with CMN/BCB Joint Resolution No. 18/2025, on the quality policy for information provided within the scope of the Central Bank of Brazil.

Irregularity register

The register fills in automatically, for example when an input breaks a flow's contract or when a data load rejects lines. Each irregularity has a category (validation, provenance, embedding, and others), a status (open, acknowledged, or resolved), and an action plan.

Data dictionary

The dictionary describes the regulated entities the platform handles (documents, document_chunks, flow_runs, chat_messages, audit_events, and data_quality_irregularities), their relevant fields, and the quality dimensions they support: accuracy, completeness, traceability, timeliness, integrity, consistency, and governance.

Governance endpoints

Available to administrator sessions:

Text
GET  /api/v1/admin/data-quality/dictionary
GET  /api/v1/admin/data-quality/irregularities
POST /api/v1/admin/data-quality/irregularities/:id/resolve
GET  /api/v1/admin/data-quality/report

The report aggregates irregularities by status and category, the provenance coverage of AI answers, and document indexing, as the basis for the semiannual report.

The platform is not, by itself, an institution authorized by the Central Bank of Brazil. These capabilities let the regulated institution that uses it demonstrate traceability, accuracy, and governance over the data generated and processed in it.

Retention and deletion

  • Retention is optional and set per organization: flow runs, chat messages, and data loads can be purged automatically after a number of days.
  • By default, nothing is purged.
  • The audit trail is never included in purges.
  • Each deletion of documents, attachments, contexts, conversations, and tables is recorded: what was deleted and by whom.

LGPD

  • Residency: content, data, and embeddings stay in the installation's databases and storage.
  • Minimization: retention with automatic purge, modules granted per person, and separate workspaces.
  • Traceability: recorded deletions and answer provenance.
  • Anonymization: the "Data anonymization (LGPD)" flow template uses an AI model to mask personal data; review the result according to the risk of each case.
  • Labels: document classification and column sensitivity organize the collection; access control is handled by module, workspace, and sharing.

These capabilities support your organization's compliance program; they do not replace legal assessment and do not constitute certification.

Export to observability

In Settings > Logs, configure the export of traces and logs over OpenTelemetry (OTLP) to your organization's collector, such as Grafana Tempo, Jaeger, or Datadog. The connection has a test and takes effect at the next restart. Export is off by default.

Documentationv3.7