Security, data and action logs
When investigating changes, distinguish account access, item-card history and till operations. This article helps you choose the right log and understand what personal-data actions actually delete.
Requirements#
- Sign in as the account owner to read the action log.
- Card history requires access to its section; it is usually available to the owner and managers, while restoring a version requires edit rights.
- Employee consents require access to the personnel file and the appropriate write permission.
- Prepare a data export before bulk changes.
Where data lives#
The registration brand determines the cloud; it is not an account switch.
| Brand | Environment | What to consider |
|---|---|---|
| cenaly.ge, cenaly.com | AWS, main region us-east-1 | The public storefront is delivered through a CDN |
| cenaly.ru | Yandex Cloud, Russia | Separate data and sign-in; this account is not a copy of an AWS account |
| Turkish brands | AWS, regional copy in eu-central-1 | This is Germany, not hosting inside Turkey |
Menus, photos and published storefront documents are available without sign-in. Private account data requires access. Moving between clouds is not a normal brand switch: it requires a separate account and data transfer.
Who has access#
| Person or access method | How to restrict or revoke it |
|---|---|
| Owner | Manages the account and grants other people access |
| Employee | Role, section levels and the intersection of role and employee-card locations; revoke sign-in when they leave |
| Cashier with a PIN | Role permissions at the till; change the PIN in the employee card |
| Device using a code | Target page and code settings; delete unused codes in QR codes → Devices |
| Support | Settings → Support access: consent, scope and revocation |
| Implementation partner | An owner-approved request with a time limit; a separate session is used |
| External agent using an API key | Key permissions; revoke it on the Access tab |
Partners receive view access by default; editing needs separate permission. During a session, a banner identifies the firm, person, mode and remaining time. Subscription, owner data, staff permissions, export, integrations, mail, calls, telephony, counterparties and documents are closed to them. Revoking consent ends the current session. Partner sign-in is unavailable on cenaly.ru.
View, Edit and Setup levels apply in connected screens. Do not treat them as universal protection for every operation: see the boundaries in Roles and permissions.
Passwords, PINs and device codes#
An account password, employee PIN and sign-in-code PIN are different access methods. Changing one does not revoke the others.
| Method | Owner’s action |
|---|---|
| Password | Change it in Settings → Access; recover a forgotten password from the sign-in screen |
| Employee PIN | 4–6 digits, unique within the account; change or clear it in the employee card |
| Device or QR sign-in code | Remove unused codes in QR codes; replace a lost code |
| API key | Save it when created: the full key is shown once; revoke it if exposed |
| Personal SIP account | Manage it in the personal SIP accounts tab; employee dismissal revokes their extension |
Failed attempts. Employee PIN: 10 failures within 15 minutes cause a 15-minute lockout for the calling employee or terminal. The terminal reports too many incorrect PINs and the remaining wait in minutes. Sign-in-code PIN: 5 incorrect non-empty PINs within 15 minutes lock the code for 15 minutes, even if the next PIN is correct.
On cenaly.ru, password sign-in limits attempts for an email-and-IP combination: 10 within 5 minutes, with a successful sign-in resetting the counter. This is not a permanent account lock. If attempts are too frequent, wait; if the password is forgotten, use recovery. AWS sign-in limits are controlled by the identity provider: there is no single attempt count for every sign-in method here.
Two-factor sign-in using an authenticator-app code can be enabled in Settings → Access on AWS brands. Do not extend that promise to cenaly.ru, mobile, Google or QR sign-in. Signing out of the web workspace ends the session across that browser’s tabs.
Action logs and change history#
1. Staff actions and access changes#
Open Staff → Action log. This tab is owner-only. It shows recorded changes to roles and access, employees, bots, triggers and campaigns, and contact operations such as imports, exports, merges and deletions.
Choose dates, section and employee; enter search text if needed. Rows show time, actor, action, object and details. Use Show more to load another batch; CSV contains the rows already loaded.
The default view covers the last 30 days. One request is limited to a 400-day range; change the dates to view an older period. This is not a retention period. The interface does not state one guaranteed retention period for entries — keep the exports you need. This is not a complete record of every page visit and catalogue edit.
2. “🕓 Change history” in an editor#
This feature is not yet available in every editor. In a connected card, click the clock button in the header. The panel lists versions: when each was saved, its attributed author and what changed. Expand a version to see Field, Before and After.
- Show this state displays earlier values where the editor supports preview; it does not save them.
- Back to current returns to the current form.
- Restore this version saves the selected state as a new version, preserving history. It requires edit permission and restore support in that editor.
If someone changed the card meanwhile, refresh history and compare again. “Unknown author” and “unverified” labels do not prove who made the change. A deleted card may no longer be openable from the normal list.
3. Till risk operations#
Open Statistics → Risk operations. Select the location, period, cashier and operation type. Look here for discounts, voids after sending, refunds, reprints and cash discrepancies. An event may include an order, amount and change details. The log itself does not require a camera.
This log concerns sales operations: editing a catalogue price and applying a manual till discount are different events. Consider author-verification labels; a name in a row alone does not replace investigation.
Who changed a price or deleted an item#
Task: yesterday a product cost ₽350; today it costs ₽300, or it has disappeared.
- Check the relevant location first: the item may be on its stop list or excluded from its menu while remaining in the shared catalogue.
- If the catalogue card changed, open it → Change history, select versions before and after the change, and compare price, time and author.
- If an item was removed from a bill or discounted during a sale, open Statistics → Risk operations and find the cashier and order.
- If granted permissions may explain the change, the owner checks Staff → Action log for the same period.
If the card was deleted, history is unavailable or the author is unverified, do not blame someone based on an empty log. Save the item name or number, location and time, then contact support. These windows do not provide a universal search for all deleted objects.
Consents and personal data#
Employees. The consent workflow is still developing. In the employee card’s Personnel tab, open Consents to personal data processing.
- Click Record consent.
- Enter the purpose, date, expiry or validity until withdrawal, and a supporting document from the personnel file.
- Save and check the entry; a summary is available in the Employee consents report.
Use Withdraw when consent is withdrawn. For publication consent, this removes the photo and description from the public booking storefront but does not delete the personnel card. If the block or action is missing, check personnel-file permissions; deleting an erroneous entry and withdrawing consent are different actions.
Guests and customers. The cookie banner controls cookie categories and the consent log; legal documents are published on behalf of your business. The owner determines their content.
My data on the storefront exports local browser data as JSON and clears it. If a current order is present, it also requests deletion of that order. Successful local clearing does not confirm deletion of all the guest’s orders, contacts and server history.
Export and deletion#
| Task | Available action | Boundary |
|---|---|---|
| Take account data | Settings → Export: select content and period, prepare a ZIP and download it | PINs, passwords, keys and tokens are excluded; photos remain links; the archive is kept for 7 days |
| Delete a guest’s data on request | Identify which details are stored in which sections; contact support for broader removal | My data is not complete server-side deletion |
| Erase a patient’s data | In the clinic workflow, the owner can use Erase patient data and state a reason | Financial facts and receipts remain; this is not a general button for deleting any customer |
| Dismiss an employee | Revoke sign-in; deleting the employee moves personnel information to an archive | This is not immediate anonymisation: documents and history remain |
| Destroy expired personnel materials | The owner reviews the Due for destruction list | Selected materials are cleared manually; this does not automatically erase the entire person |
| Delete an account | Export first and contact support | This guide does not promise working self-service deletion of the whole account; timing is agreed for the request |
Backups#
There is no button to restore the whole account to a date. Export before imports or bulk clean-ups. Card history can restore a version where restoration is connected, but does not replace an account backup. No internal-copy retention period or guaranteed recovery time is promised here.
If you suspect a leak#
- Change the owner’s password and disable unnecessary support access; check session history where available.
- Revoke suspicious device codes, QR sign-in codes and API keys. Change PINs known to outsiders and revoke former employees’ sign-in access.
- Save available logs: location, time, actor, order number or object.
- Contact support with those details. Report a platform vulnerability to
security@cenaly.com, including the page and steps to reproduce.
Result: suspicious access methods are revoked and investigation details preserved. If a relevant log is unavailable, report that together with the event time.
Limitations#
- Action, version, time-clock and till logs have different coverage; they are not one complete account audit.
- Version history is not connected everywhere yet, older entries may have unknown authors, and restoration depends on the editor and permissions.
- Some AWS features are unavailable on cenaly.ru: partner sign-in, support-session history, account transfer to another email, the cookie scanner and the TOTP sign-in described above.
- There is no single portal that automatically exports and erases all a person’s data across every section.
- The payment provider handles the card during online payment; exports exclude access secrets. Passkey sign-in may use device biometrics — that is not an account personnel database of fingerprints.
Troubleshooting#
| Symptom | Cause | What to do |
|---|---|---|
| Action log tab is missing | You signed in as an employee | Ask the owner to open the log |
| CSV has fewer rows than expected | Only loaded rows are exported | Check filters and use Show more |
| History button is missing | The editor is not connected or permission is missing | Check access and contact support with the card name |
| Restore was refused | Someone changed the card meanwhile, or write permission is missing | Refresh history, compare versions and check permissions |
| PIN is temporarily refused | Guessing protection was triggered | Wait as instructed; the owner checks the PIN or revokes the code |
| Documents remain after dismissal | The personnel archive is retained | Review the archive and Due for destruction separately |
| Details remain after the guest cleared their browser | Local clearing does not cover all history | Clarify the request’s scope and contact support |
FAQ#
Can support enter without my permission? A normal support session requires Support access to be enabled; you choose its scope and can revoke consent.
Can I restore a price? Yes, in an editor with history and restore support, with edit permission. Check location-specific prices separately.
Does dismissal erase personal data? No. It revokes access; personnel information may remain in the archive.
Where can I get data-processing documents? See the DPA; request a signed copy and additional documents from support.
Related articles#
- Account and sign-in, Settings — access and sign-in methods.
- Roles and permissions, Staff — people’s access.
- Time clock — clock actions and corrections.
- Data export, Customers — handling data.
- Cookies and consent, Legal documents — guest consents.
- Support — help and incident reporting.