Audit logs

Track every admin action in your org — what changed, who changed it, and when.

What gets logged

The audit log records every administrative action taken in your organization. It's append-only — entries cannot be modified or deleted. The log captures:

Category	Examples
Settings changes	SSO enabled, connection type blocked, skill policy updated
User management	User invited, role changed, user suspended, user deleted
Team changes	Team created, member added/removed, team admin assigned
Skills	Skill installed org-wide, skill approval granted/denied
Connections	Connection revoked by admin, org-wide pre-auth configured
SCIM events	User provisioned, user deprovisioned, group sync run
SSO events	SSO configuration saved, test performed, enforcement toggled

End-user actions (creating tasks, sending emails, booking meetings) are not in the audit log — those are in task activity, which is accessible per task. The audit log is strictly for administrative changes.

Browsing the log

Go to Organization → Audit log to browse entries. Each entry shows:

Timestamp — exact time of the action (UTC)
Actor — the user who performed the action, with their email and role at the time
Action — a structured description of what changed
Before / after — the previous and new value for settings changes

You can filter by date range, actor, or action type. The dashboard shows the last 90 days of entries.

Exporting logs

For long-term retention or SIEM integration, configure delivery to an S3 bucket under Organization → Audit log → Configure delivery.

You'll provide:

S3 bucket name — the bucket the platform will write to (must exist in advance)
IAM role ARN — a role in your AWS account that the platform can assume to write to the bucket
Delivery prefix — optional path prefix, e.g. audit-logs/
Frequency — hourly or daily batch delivery

Logs are delivered as newline-delimited JSON (NDJSON), one file per delivery period. Each line is one audit event in the same structure shown in the dashboard.

Required IAM policy

The role you provide must allow the following on your bucket:

{
  "Effect": "Allow",
  "Action": ["s3:PutObject", "s3:PutObjectAcl"],
  "Resource": "arn:aws:s3:::your-bucket-name/audit-logs/*"
}

The trust policy must allow the platform's delivery account to assume the role:

{
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::254652354196:root" },
  "Action": "sts:AssumeRole"
}

After saving the configuration, click Test delivery — the platform will write a test file to confirm permissions are correct before enabling scheduled delivery.

Retention

The dashboard retains audit log entries for 90 days. If you need longer retention for compliance, configure S3 delivery and manage retention there using S3 lifecycle policies.

There is no way to extend the dashboard retention window — for anything beyond 90 days, S3 delivery is the correct path.

Compliance use cases

The audit log is designed to support common compliance requirements:

SOC 2 — the log provides evidence of access control changes and administrative activity. Export entries for the audit period to share with auditors.

HIPAA — if your org processes protected health information, the audit log documents who had administrative access and when it changed.

GDPR / data deletion — user deletion events in the audit log serve as evidence that data was removed upon request.

For compliance exports, filter by date range and export as CSV from the dashboard, or pull the relevant date range from S3 if you have delivery configured.