Skip to main content

Audit log

Updated

Overview

The audit log is a chronological record of administrative actions taken in your Hub organization. Owners and Admins use it to track user changes, role assignments, product access modifications, and configuration updates. Entries are retained for 90 days.

What the Audit Log Tracks

The audit log records the following types of events:

  • User events — user invited, user created, user updated, user deactivated, user reactivated, user deleted.
  • Role events — role created, role assigned, role changed, role removed.
  • Permission events — product access granted or revoked, permission overrides.
  • Client events — managed client added, updated, or removed.
  • Configuration events — org settings changed, branding updated, portal domain verified.
  • Notification events — notification preferences updated.

Each entry includes:

  • The actor — who performed the action (name, email, and source IP address).
  • The target — the user, role, or object that was changed.
  • The action — a description of what was done.
  • A timestamp of when it happened.

Actions taken by the system (such as auto-expiring invites or dunning state changes) are also logged.

Filtering Events

  1. Go to Settings → Audit Log (/settings/audit).
  2. Use the filters at the top of the page:
    • Action type — filter to a specific category (user events, role events, etc.).
    • Actor — filter to events performed by a specific team member.
    • Date range — narrow to a specific time window.
  3. Results update as you adjust the filters.

The log is paginated. Use the pagination controls at the bottom to step through older entries.

Exporting the Audit Log

To export a filtered view of the audit log:

  1. Apply any filters you want (date range, action type, actor).
  2. Click Export at the top of the audit log page.
  3. A CSV file is downloaded containing all matching log entries.

The export includes all visible columns: timestamp, actor email, action, target type, target ID, and source IP.

Frequently Asked Questions

How long are audit log entries kept?

Entries are retained for 90 days. Events older than 90 days are removed automatically and cannot be recovered.

Can Members or Viewers see the audit log?

No. The audit log is visible to Owners and Admins only.

Can I see which IP address was used for a specific sign-in attempt?

The audit log records the source IP for actions performed by authenticated users. Sign-in attempts (including failed ones) that do not result in a session are not recorded in the audit log — those are handled at the authentication layer.

Is there a separate log for permission denials (when someone tries to do something they don't have access to)?

Yes. Go to Settings → Permission Denials (/settings/permission-denials) for a dedicated log of access-denied events. This is useful for catching misconfigurations or unauthorized access attempts.

Can I set up alerts when specific audit events happen?

Not directly from the audit log page. For proactive monitoring, consider exporting the log regularly or contacting support about webhook-based notifications.

Related