Who did what, signed by the one who did it.
Every noted action goes to an activity file that only that person can sign — nobody puts words in her mouth — and that only she, the owner and her division's administrators can read. Nineteen of those actions can mail chosen people the moment they happen, batched so a busy afternoon is one message, not two hundred.
The nineteen triggers
Kept in the store. Sent from your server.
No LockFlare server carries a message. The organization's own SMTP server does, and members' Sondas send through it.
The activity log
One file per person per month, signed by that person alone, sealed to the person, the owner and the division's administrators. Repeats within ten minutes coalesced; up to 5,000 lines wait on a computer that is offline. "My activity" for everyone; Activity for the administrators. Permission refusals are recorded too.
One SMTP server set by an administrator — TLS on 465, STARTTLS on 587 — published into the division document sealed to its people. A login over no TLS is refused unless the host is local. Divisions can override the organization's server.
What else is mailed
Invitations. Approval requests and decisions. The directory sync's report. The notifications a lock sends when it is taken, released or lifted.
Approvals and locks