Help CentreThe Audit log page in Settings records significant actions taken in your organisation, so you can see who changed what and when. You'll see it if your role can view organisation settings; by default that's Organisation Owners and Organisation Admins.
What gets recorded
The log covers actions that change how your organisation runs, not everyday reading and viewing:
- Member role changed and Role permissions updated
- Risk score overridden
- File archived, File permanently deleted, and File reassigned
- Case label updated
- Team created, Team deleted, Team member added, Team member removed
- API key created and API key revoked
ℹ️ The log is recorded on a best-effort basis, so treat it as a strong record of significant activity rather than a guaranteed record of every action.
Reading the log
Each entry shows:
- When: in your local timezone.
- Action: which of the events above happened.
- Who: the person who did it, by name and email. If they've since been removed from your organisation, they're shown as Deleted user.
- Target: what the action applied to (a member, a team, a file, a key).
- Details: a plain-English summary of what changed, such as the old and new role.
Filtering
Use the filters in the column headers to narrow the log:
- Action: one event type, or All actions.
- Actor: one person, or All actors.
- From / To: a date range.
The page shows 25 entries at a time, and you can raise that to 50 or 100. Your filters are kept in the page's web address, so you can bookmark a filtered view or share it with a colleague.