# Access records

Every export and erasure is recorded: who asked, for which person's `id`,
and when, never the values. So is every read of a sensitive field. These
are log events kept for a long time, so your organisation can show a
regulator what it did.

Reads of ordinary personal data aren't recorded one by one.