Two safety nets sit under everyday work in Panzo: an access audit log that records who changed access and who impersonated whom, and a recycle bin that keeps deleted records for 30 days so a mis-click is never a disaster. This guide is for owners and admins.

The access audit log

Privileged admin actions leave a durable record, so you always know who did what and when. The log captures the sensitive events that change who can do what in your workspace, not routine edits, so it stays a clear, short trail you can actually read.

Event	What is recorded
User created	The new person's email, their Role and their Profile.
Access changed	A from/to diff of the role, profile, approver flags and active status, logged only when something actually changed.
View As started and stopped	Each impersonation, recorded against the real admin who ran it, not the person they viewed as.

This matters most when access is questioned after the fact. If a payment was approved by someone who should not have had the power, or a role was widened just before a mistake, the log tells you who made the change and when, in one place.

Note

Impersonation is never anonymous

When an admin uses View As to step into a colleague's account, the start and stop are both logged against the real admin. Actions taken during that session are attributed to the actor, so impersonation can never be used to act in the dark.

The 30-day recycle bin

When someone deletes a project, lead, deal, customer, quote, task, activity, product or service ticket, it does not vanish. It moves to the Recycle Bin in Control Panel, where it can be restored for 30 days. After that it is removed permanently and automatically, so the bin never grows without bound and you never have to do manual housekeeping.

Deleting a record also snapshots the child rows that belong to it, so restoring a project brings back its tasks, phases, documents and follow-ups, not just the shell. Every delete asks for confirmation first and the prompt tells you the record is recoverable, so nobody has to fear the button.

Important

Money and aftercare records are protected, not silently cascaded

A record that other records depend on cannot be deleted out from under them. If a project still has service invoices, payment receipts, service tickets, installed assets or warranties attached, the delete is refused with a plain notice rather than quietly taking those money and aftercare records with it. Clear or move the dependent records first if you genuinely need to delete.

Deleting and restoring

Delete a record
Open the record and use Delete in the header, or select rows in a list and use the bulk Delete. Confirm. It moves to the bin.
Open the Recycle Bin
Go to Control Panel, then Recycle Bin under Data Management. Each item shows what it was, who deleted it, when, and how many days remain.
Restore or remove for good
Use Restore to put a record back where it was, or Delete Forever to remove it immediately. Restore and permanent removal are admin-only.

Tip

A very large record can come back with loose ends

The record and its main child data always return. For a very large, deeply connected record, some loosely linked references may come back detached, so give a big restore a quick check.

Key takeaways

The access audit log records user creation, access changes with a from/to diff, and every View As session.
Impersonation is always logged against the real admin, so it is never anonymous.
Deleted records move to the recycle bin and are restorable for 30 days, then purged automatically.
A delete snapshots the record's children too, so a restore brings back the whole thing.
Deletes that would destroy money or aftercare records are refused rather than silently cascaded.

The access audit log and recycle bin