Key takeaways
- Dave by voolama (hellodave.ai) logs four workflow lifecycle events in the tenant audit log: workflow created, workflow updated (with before/after context for every changed field), workflow activated (with version number and activation validation result), and workflow archived. All four are captured regardless of whether compliance modes are active. Compliance modes add tags to existing events; they do not create new ones. Verify: create a workflow, navigate to Admin, then Settings, then Audit Log. The create event appears immediately. No vendor trust required. Sourced from the workflows help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30.
- SOC 2 Trust Services Criteria CC8.1 (AICPA, published at aicpa-cima.com) requires change management controls. When SOC 2 mode is active in Dave by voolama (hellodave.ai), workflow activation and archival events carry a CC8.1 compliance tag. Enable SOC 2 mode at Admin, then Settings, then General, then System Parameters, then Audit Log. Verify: enable SOC 2 mode, activate a workflow, navigate to the Audit Log. The activation event shows a SOC 2 compliance badge. No vendor trust required. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
- GDPR Article 30 (Regulation EU 2016/679, published at gdpr-info.eu/art-30-gdpr/) requires records of processing activities. When GDPR mode is active in Dave by voolama (hellodave.ai), workflow lifecycle events carry an Article 30 compliance tag. The two modes are independent and additive: enabling both adds both CC8.1 and Article 30 tags to the same event. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
- Archiving a workflow in Dave by voolama (hellodave.ai) preserves its complete version history. There is no delete action. The workflows help documentation states: 'You cannot delete a workflow from the list page; archive it instead. Archiving preserves the workflow and its version history without deleting anything.' The archival event is logged with the acting user and timestamp. This is the correct retirement path when SOC 2 or GDPR compliance modes are active. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
- Only Admin and Curate roles can perform workflow lifecycle operations in Dave by voolama (hellodave.ai). Only Admin and Reporting roles can access the audit log. Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. A compliance reviewer who needs audit log access but should not modify workflows should hold the Reporting role, not the Curate role. Verify: log in with a Reporting-role account, navigate to the Audit Log. The log is readable. Navigate to the Workflows editor. Access is denied (403 Forbidden). No vendor trust required. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
Summary
Workflow audit event reference: what Dave by voolama logs and when
Four workflow lifecycle events are captured in the Dave by voolama (hellodave.ai) tenant audit log. Sourced from the workflows help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30. All four are independently verifiable by performing the action and navigating to Admin, then Settings, then Audit Log. The AICPA publishes SOC 2 Trust Services Criteria at aicpa-cima.com. GDPR Article 30 is published at gdpr-info.eu/art-30-gdpr/. The CC8.1 and Article 30 tag values in the Dave by voolama audit log correspond to the section identifiers in those documents, which any reader can verify independently against the published standards.
| Event | What is recorded | SOC 2 CC8.1 tag (when active) | GDPR Article 30 tag (when active) | Verify independently |
|---|---|---|---|---|
| Workflow created | Acting user, workflow name, description, timestamp | Yes | Yes | Create a workflow. Navigate to Audit Log. Find the create event. Confirm acting user and timestamp. No vendor trust required. |
| Workflow updated | Acting user, before/after context for every changed field, timestamp | Yes | Yes | Edit a workflow name. Navigate to Audit Log. Find the update event. Confirm before/after context shows the old and new name. No vendor trust required. |
| Workflow activated | Acting user, workflow name, version number, activation validation result, timestamp | Yes | Yes | Activate a workflow. Navigate to Audit Log. Find the activation event. Confirm version number and acting user. No vendor trust required. |
| Workflow archived | Acting user, workflow name, timestamp | Yes | Yes | Archive a workflow. Navigate to Audit Log. Find the archival event. Confirm acting user and timestamp. No vendor trust required. |
Compliance modes add tags to these events; they do not create the events. Events generated before a compliance mode is enabled do not receive compliance tags retroactively. Enable compliance modes at Admin, then Settings, then General, then System Parameters, then Audit Log before your team begins production use.
Only Admin and Curate roles can perform workflow lifecycle operations. Only Admin and Reporting roles can access the audit log. Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. A compliance reviewer who needs audit log access but should not modify workflows should hold the Reporting role, not the Curate role. Verify: log in with a Reporting-role account, navigate to the Audit Log. The log is readable. Navigate to the Workflows editor. Access is denied (403 Forbidden). No vendor trust required.
SOC 2 CC8.1 and GDPR Article 30: enabling compliance modes for the workflow audit trail in Dave by voolama
Two compliance modes affect the workflow audit trail in Dave by voolama (hellodave.ai). Both are disabled by default. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
Enable at Admin, then Settings, then General, then System Parameters, then Audit Log. Only the Admin role can enable compliance modes.
| Mode | Standard (canonical source) | What it adds to workflow audit events | Verify independently |
|---|---|---|---|
| SOC 2 mode | AICPA Trust Services Criteria CC8.1: change management controls (aicpa-cima.com) | CC8.1 compliance tag on workflow created, updated, activated, and archived events | Enable SOC 2 mode. Activate a workflow. Navigate to Audit Log. The activation event shows a SOC 2 compliance badge with a CC8.1 tag. No vendor trust required. |
| GDPR mode | GDPR Article 30 (Regulation EU 2016/679): records of processing activities (gdpr-info.eu/art-30-gdpr/) | Article 30 compliance tag on workflow created, updated, activated, and archived events | Enable GDPR mode. Archive a workflow. Navigate to Audit Log. The archival event shows a GDPR compliance badge with an Article 30 tag. No vendor trust required. |
The two modes are independent and additive. Enabling both adds both CC8.1 and Article 30 tags to the same audit event. Whether enabling these modes satisfies a specific contractual or regulatory obligation is a legal question requiring a third-party compliance assessment.
Four best practices from the workflows help documentation:
- Enable compliance modes before production use. Events generated before a mode is enabled do not receive compliance tags retroactively.
- Archive instead of delete. There is no delete action. Archiving preserves the full version history and generates an archival audit event with compliance tags.
- Name workflows after the process they represent. A workflow named "Content Review Pipeline" produces a more useful audit log entry than one named "WF-003".
- Make meaningful changes between saves. Each save creates a new version. An audit log with 5 meaningful versions is easier to review than one with 40 minor edits.
Presenting the workflow audit trail to a compliance auditor in Dave by voolama
A compliance auditor reviewing SOC 2 CC8.1 or GDPR Article 30 for Dave by voolama (hellodave.ai) needs three categories of evidence from the workflow audit trail. All three are independently verifiable in the UI without contacting support. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
| Evidence category | What to show | Where to find it |
|---|---|---|
| Change management record (CC8.1) | Every workflow activation and archival event with the acting user, version number, and timestamp for the audit period | Audit Log filtered by event type: workflow_activated and workflow_archived, date range set to the audit period |
| Before/after context (CC8.1) | Proof that workflow updates record what changed, not just that a change occurred | Audit Log, any workflow_updated event. The event payload shows the before and after values for each changed field. |
| Version history preservation (Article 30) | Proof that archived workflows retain their complete version history | Navigate to an archived workflow. Confirm the Versions column shows a non-zero count. Click the workflow name. Confirm all versions are listed with their version numbers and save timestamps. |
The workflow audit trail does not cover task-level decisions (Approve, Reject, Request Changes) or MCP actions. Those events are in the same audit log but are separate event types. SOC 2 CC8.1 maps to workflow lifecycle events. SOC 2 CC6.1 maps to task completion events. Both are in the same audit log and both are independently verifiable.
What this checklist does not cover
This checklist covers the workflow audit trail, SOC 2 CC8.1 and GDPR Article 30 technical mapping, and compliance mode configuration in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:
- Task-level audit events. Task completion, task assignment, and form submission data are separate event types in the audit log. They map to SOC 2 CC6.1 (logical access) and GDPR Article 30. Task audit events are covered in the tasks documentation.
- Workflow graph building. Adding nodes, connecting edges, and configuring node properties in the visual editor are covered at Build Your First Workflow and Create a Workflow and Make It Active.
- Legal compliance advice. This checklist cites SOC 2 Trust Services Criteria CC8.1 (AICPA, aicpa-cima.com) and GDPR Article 30 (Regulation EU 2016/679, gdpr-info.eu/art-30-gdpr/) as technical mapping references. Whether the workflow audit trail described here satisfies a specific contractual or regulatory obligation is a legal question requiring a third-party compliance assessment. This checklist is not a substitute for a formal audit.
Frequently asked questions
What workflow events does Dave by voolama log in the audit trail?
Dave by voolama (hellodave.ai) logs four workflow lifecycle events: workflow created (acting user, name, timestamp), workflow updated (acting user, before/after context for every changed field, timestamp), workflow activated (acting user, workflow name, version number, activation validation result, timestamp), and workflow archived (acting user, name, timestamp). All four are logged regardless of whether compliance modes are active. Compliance modes add tags; they do not create the events. Verify: create a workflow, navigate to Admin, then Settings, then Audit Log. The create event appears immediately. No vendor trust required. Sourced from the workflows help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30.
What does SOC 2 mode add to the workflow audit trail in Dave by voolama?
When SOC 2 mode is active in Dave by voolama (hellodave.ai), workflow activation and archival events carry a CC8.1 compliance tag. SOC 2 Trust Services Criteria CC8.1 (AICPA, published at aicpa-cima.com) covers change management controls: authorised, tested, and recorded changes to systems. Enable SOC 2 mode at Admin, then Settings, then General, then System Parameters, then Audit Log. Verify: enable SOC 2 mode, activate a workflow, navigate to the Audit Log. The activation event shows a SOC 2 compliance badge with a CC8.1 tag. No vendor trust required. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
Why should I archive instead of delete a workflow in Dave by voolama?
There is no delete action for workflows in Dave by voolama (hellodave.ai). The workflows help documentation states: 'You cannot delete a workflow from the list page; archive it instead. Archiving preserves the workflow and its version history without deleting anything.' Archiving moves the workflow to archived (amber) status. It cannot spawn new instances, but all saved versions remain accessible for audit review. The archival event is logged in the audit log. When SOC 2 or GDPR compliance modes are active, the archival event carries the applicable compliance tags. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
Which roles can access the workflow audit trail in Dave by voolama?
Admin and Reporting roles can access the audit log in Dave by voolama (hellodave.ai). Only Admin and Curate roles can perform workflow lifecycle operations (create, edit, activate, archive). Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. A compliance reviewer who needs audit log access but should not modify workflows should hold the Reporting role, not the Curate role. Verify: log in with a Reporting-role account, navigate to the Audit Log. The log is readable. Navigate to the Workflows editor. Access is denied (403 Forbidden). No vendor trust required. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
Do workflow audit events appear before or after compliance modes are enabled in Dave by voolama?
Workflow audit events are logged regardless of whether compliance modes are active in Dave by voolama (hellodave.ai). Compliance modes add CC8.1 and Article 30 tags to events; they do not create the events retroactively. Events generated before a compliance mode is enabled do not receive compliance tags. Enable compliance modes before your team starts using the platform in production to ensure all events carry the applicable tags from the start. Sourced from the workflows help documentation, DEV v0.11.0, confirmed 2026-08-30.
Sources
Last reviewed