Export evidence for review

On the free plugin

Export is part of RuleFence Pro, which adds an Export control to the Activity screen. The free plugin keeps the record on your site and does not export it.

To keep a copy on the free plugin, take a full database backup. The activity trail lives in the plugin’s own database tables, so a backup holds it together with its chain.

Keep a copy before these

• Shortening retention. The window you drop is gone.
• Restoring a database backup. You will get an earlier chain, not this one.
• Uninstalling with data removal opted in.
• Handing a site to a new owner or agency.
• Any incident you may need to explain later. Keep the copy while the record is complete, not after you have started fixing things.

What a Pro export contains

• Every event matching your current Activity filters, as CSV or JSON: when it happened, which agent, which Ability, the decision, and the outcome.
• The event context, redacted again on the way out, so sensitive input does not leave the site in the clear.
• Each event’s chain hashes, and the chain status at the moment of export, so a reviewer can re-check the chain without trusting a status line.

Handling the file

An export is still operational data about your site. Treat it accordingly: send it over a channel you would use for other sensitive material, keep it only as long as the review needs it, and do not paste it into a public forum thread.

Who reads it

Records are written in operational language, so an export is readable by someone who did not build the integration — an auditor, a client, a colleague picking up an incident. That is deliberate: evidence only counts if the person who needs it can read it.

Related guides

• EvidenceSet audit retention

  Retention is opt-in: once applied, the free plugin keeps 30 days or 10,000 events, and RuleFence Pro sets a custom window. Removing evidence always needs confirmation.

• EvidenceWhat is redacted, and when

  Sensitive input is redacted on the way out — when a record is displayed or exported — not discarded on the way in. Why that ordering matters.

• EvidenceVerify the audit chain

  HMAC-SHA-256 chaining with a signed head means the record can prove it has not been edited. How to run a full-chain verification and when it is worth doing.