Skip to main content

Audit log

The audit log records security and administration events — sign-ins, account security, settings, roles and deletions. It is kept separate from the activity feed of boards and tasks.

There are two views:

  • Admin → Audit log — the whole instance. Owner, Admin and Auditor staff can read it; Support staff can't.
  • Settings → Workspace → Audit log — one workspace's events, for that workspace's admins. It shows no IP addresses.

What is recorded​

In Admin → Audit log​

  • Sign-ins and failed sign-ins for existing accounts (wrong password, wrong two-factor code, disabled account). What was typed is never recorded.
  • Account security: password changes and resets, two-factor authentication on and off, recovery codes, passkeys, sessions signed out, API keys created and revoked.
  • Account recovery by staff: the action, the target, and the reason the staff member gave.
  • Email verification: addresses confirmed (by link, by an invitation, or marked as verified by staff), verification emails resent by staff, and unconfirmed sign-ups deleted by the daily job. A deleted sign-up is recorded with its email domain only, never the address.
  • Staff role changes (from → to). Changes made by single sign-on group sync name the provider.
  • Instance settings and sign-in providers, with each changed value before and after. Secrets, such as an OIDC client secret, are never logged.
  • Account exports and deletions.
  • Workspace lifecycle: created, deleted, restored, purged.

It also shows every workspace's own events (see below).

In a workspace's audit log​

Creation, settings changes, member role changes and removals, join request decisions, public link changes (never the password), and export, delete and restore.

Reading the log​

  • Newest events come first, 50 per page.
  • Each row is a sentence, for example "Mara changed the role of Jonas from Member to Workspace admin", with the time, the workspace name and the IP address.
  • Use the filter chips to show one kind of event, or All.
  • Events without a person, such as the daily jobs or single sign-on sync, show "The system".
  • Names are stored as they were at the time, so events stay readable after an account or workspace is deleted. A deleted account's own deletion is recorded by id only.

Auditors see users' email addresses masked.

tip

Every account recovery action requires a reason. Ask your support staff to put the ticket number in it, so each entry in the log can be traced back to a request.

Retention​

Events are kept for 365 days by default. To change it:

  1. Open Admin → General.
  2. Under Audit log, set Keep events for (days) — from 30 to 3650.

A daily cleanup deletes older events. The change itself is recorded in the audit log. A workspace's audit log follows the same retention.

Audit events are kept when a workspace or account is deleted, until they reach the retention limit.

note

There is no export button for the audit log. Its data lives in the database, so it's included in your regular backups.