Audit log
What the audit log records and does not yet record, how to filter and export it, who can see it, and why it cannot be edited.
The audit log is the workspace's record of security-relevant events. Open More, then Audit. Only Owners, Super admins and Admins can view it.
It cannot be changed#
The database refuses to update or delete audit rows, for every role, and refuses to truncate the table. A deleted workspace's own trail is removed only with the workspace itself. This is enforced by triggers and revoked privileges in the database, so no application bug and no administrator can quietly edit history.
What is recorded#
- Members and roles: invitations, role changes, removals, ownership transfers.
- Settings: workspace settings, AI settings and AI provider changes.
- Access tokens: token activity.
- Security: security events and workspace switches.
- Knowledge: requests that change knowledge, such as an export.
- Exports and imports: each export, import and download, including those made with a token (with the token's id).
- Meetings.
Events carry a severity, and each shows who did it, what, and when.
What is not recorded yet#
Filter#
Narrow by activity (Members and roles, Invitations, Knowledge, Meetings, Settings, AI providers, Security, Access tokens, Workspace switches) and by time window, and search within the result.
Export it#
Administrators can export the audit trail as JSON for a time window under Settings, then Compliance, then Audit trail export. See Settings.