Most parish office work is done by volunteers, part-timers and accounts that exist for a season. The Activity Log is how the parish can still answer, months later, "who did this, and what did it look like before?"
Open Governance → Activity Log. Each line is one action, newest first, and carries:
Automatically, at the database. For the records that matter most, the database itself writes the entry the moment a row is added, changed or removed. No screen or person is involved, so a change cannot slip past because someone forgot to record it — and it is captured even when Nave's own maintenance jobs make the change. A save that changes nothing is skipped.
As a "someone looked" event. Opening a sensitive record changes no row, yet it is exactly what a parish may need to account for. So certain pages write an entry when opened or exported, naming the person, the time and their network address — as Notice, not Critical: looking is not wrong, it is simply on the record.
Who did it is taken from the sign-in session on the server, never from anything a form could type in. The person's email and job are copied into the entry at that moment, so the trail still reads correctly after they change roles or their account is removed. A deleted volunteer account does not take its history with it.
The log is selective by design. It records the decisions a parish may be asked about later, and it masks the details nobody needs a second copy of.
The trail records that a field changed, not always what it held. Before any snapshot is written, these are replaced with three asterisks: social security and national ID numbers, dates of birth, the locations of uploaded documents and files, security tokens, network address and browser details captured on public forms, a candidate's full intake form, and confidential staff or interview notes. The point is that the Activity Log never becomes a second, longer-lived copy of the private information it exists to protect. Names and case numbers stay, because the log has to be able to say what was deleted.
Everyday content — events, Mass times, ministry descriptions — is not recorded, nor is a parishioner submitting a public form. Recording all of it would bury the entries that matter under thousands that do not, and a log nobody reads protects nobody.
The page shows the most recent three hundred entries for your parish. Two filters narrow it; there is no free-text search box.
Set in: People & Team → Access, the Activity log row.
Read is the only level offered, because reading is the only thing anyone can do here. The Pastor, Site admin and Parish council jobs start with it; anyone else needs it granted. The office as a whole deliberately does not have it — the log exists to hold those with access accountable, so its audience is oversight. Nave's own platform operators can read it across parishes for incident response.
Like every back-office section, Activity Log has a switch on the Features page under Governance. Switching it off hides the page; it does not stop recording, which happens at the database and on the pages being used.
An entry with no person behind it — a bulk import, a scheduled overnight job, or Nave acting on the parish's behalf — is shown as System. It is never attributed to whoever happened to be signed in at the time, because that would be a guess dressed up as a fact.
There is no screen, button or setting for it. The log accepts only additions, through the database's own guarded paths; no account, at any level of access, has a way to alter or remove a line. An entry is evidence precisely because the people it describes cannot touch it.
Every night, entries older than the retention window — 730 days by default, and never less than 30 — are cleared. Two years is right for ordinary office churn and wrong for the question an allegation or a diocesan audit asks late: "was this person cleared and serving in that year, and who said so?" So these are never aged out:
The clean-up itself writes a Notice entry saying how many rows it removed and which kinds it kept — so even deleting history is on the record.
Choose the Announcements chip. Deletion is a Critical entry and carries the notice's title and text as they were before it went. This exact situation — a missing notice and no way to say who removed it — is why announcements were added to the trail.
No. Opening Parishioners, Safe Environment, sacrament cases or finance pages is always recorded, for everyone, and marked Notice. Nobody is expected to avoid these pages — only to be accountable for them.
Events, Mass times and most other content are not on the trail. The log records access, the record of record, safeguarding, money, people and unrecoverable deletions. If you need to know who changed an event, that is not a question the Activity Log answers today.
No. Their email and job were copied into each entry when they acted, so every line still reads correctly. Click their name on any entry to see everything they did.
There is no search box or export button. Narrow it with the area chips and by person, then print the page from your browser if you need a copy.