← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Audit log for Dify apps

Dify runs chatbots, agents and workflows server-side and keeps a record of every conversation and workflow run in its own console. That record is useful for reviewing app behaviour, but it is not audit evidence in the sense EU AI Act record-keeping asks for: it lives in a database your team administers, nothing detects an edit, and retention is tied to how long you keep that database around.

What to record

• Every call to the configured model provider: model, parameters, response, token usage.
• Every tool or plugin invocation a workflow or agent step makes, with its arguments and result.
• Which node in a Dify workflow produced which action, so a chain of steps stays attributable.

Where model calls actually happen

Dify is open source and self-hostable, and its backend is the single place every model call passes through regardless of which front end or channel triggered it. If you self-host Dify, the reliable point to record is that backend boundary: wherever your deployment constructs the client for the configured provider, wrap it with @vetro/openai's wrapOpenAI or @vetro/anthropic's wrapAnthropic (both duck-typed, no dependency on Dify's own code) before the call goes out. This mirrors the pattern in the Pydantic AI guide: wrap once, record every call from then on.

If you use Dify as a hosted service without backend access, the fallback is Dify's own API: log requests and responses at your application's boundary with Dify, which sees less than the backend does but is still evidence you control.

Tool and workflow nodes

Dify's workflow "Tool" and "Code" nodes execute outside the model call entirely. Treat each as a tool call in the same shape as any other adapter: record the resolved input before it runs and the output after, and check an inline policy before the node executes, not after.

If you already export traces

If your Dify deployment is configured to export execution traces to an OpenTelemetry-compatible collector, treat that OTLP export as a starting point rather than final evidence — it shows what your pipeline captured, not that it is unedited (see OpenTelemetry GenAI traces as evidence).

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers. Retention is a separate question — check yours here. When you need something to hand to an auditor, Vetro Attest issues a 29 USD counter-signed report mapping the evidence to EU AI Act articles.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.