Audit Trail
This is the help text the console shows in the help panel on this page.
The Audit Trail is a chronological, hash-chained log of every security-relevant event that occurs in your organization. Each entry stores the hash of the entry before it, so changes to past entries show up when the chain is verified. It provides a single authoritative record for compliance audits, incident investigations, and internal governance reviews. It requires The Growth plan or higher and is available to Owners and Managers from the user menu (your name at the bottom of the sidebar) → Audit Trail.
What Is Recorded
Every significant action in the platform is automatically captured — there is nothing to configure and no events can be omitted or altered. Recorded categories include:
- Access — access detected, reviews approved or rejected, remediations closed.
- Users & Admin — invitations, role changes, API key creation/revocation, integration connections.
- Employees — creation, updates, terminations, and lifecycle changes.
- Assets — creation, updates, deletions, and credential changes.
- ISO / Compliance — scope sign-offs, risk register changes, SoA updates, policy decisions, and certificate uploads.
- Access Reviews — campaign creation, distribution, responses, and closure.
- Backup & Audit — backup test sessions, internal audits, and management reviews.
- Data Privacy — exports downloaded, audit trail exports, and PII erasure events.
- Billing — plan changes and billing intent lifecycle events.
Actions performed with an API token are marked with an API token badge so you can tell machine activity from people.
Filtering
Use the toolbar to narrow the view before exporting or sharing with auditors:
| Filter | Description |
|---|---|
| Action | Select a specific action from the dropdown (All Actions by default). |
| Subject Type | Select the kind of record the action applied to (All Subject Types by default). |
| Actor Name | Match events by the exact name of the user or system that performed the action. |
| From / To | Restrict the time window using date pickers (Start Date, End Date). |
Click Apply to run the filter and Reset to clear all criteria and return to the default view.
Event Details
Click a row to open Event Details, which shows the actor, subject, timestamp, the field-level Changes (Was / Now) and the chain proof for that entry.
Exporting
- CSV — exports the current filtered result as a spreadsheet. Useful for feeding into SIEM tools, auditor portals, or custom analysis.
- PDF — generates a formatted audit report suitable for presenting to auditors or attaching to evidence packages.
Both exports respect the active filters, so scope the date range and action before exporting to produce a targeted evidence artifact.
Sequence Numbers and Verification
Each event is assigned a monotonically increasing sequence number (Seq #). Auditors can verify that no events have been deleted or reordered by checking for gaps in the sequence. A missing sequence number is evidence of tampering.
Each row also shows a status icon: Verified (the entry and its link to the previous entry check out), Unverified (they do not), or an accepted historic link break approved by an administrator. Hover over the icon for details.
Compliance Use Cases
- ISO 27001 A.8.15 — Log management and protection: the Audit Trail satisfies the requirement to maintain and protect activity logs for all information systems.
- SOC 2 CC7.2 — Monitoring of system components: continuous event capture demonstrates that security-relevant actions are being detected and recorded.
- GDPR Article 30 — Records of processing activities: actor and subject data in each entry supports data-processing documentation requirements.
- Access Review Evidence — Export filtered logs for a specific review period and asset to provide auditors with a chain of custody for every access certification decision.
Was this page helpful?