Audit log

What gets recorded

The audit log keeps the relevant actions performed in your organization: who created, changed, or removed what, and when. It exists for the two questions that follow any incident — what happened, and who did it.

You can filter by organization and by user, which are the two cuts a real investigation uses.

Workspace access shows up here

When someone consults your organization's data through a workspace grant, that is recorded in your log — not theirs.

It is a decision about who needs the information. Granting access to a group is reasonable; granting invisible access is not. Whoever is observed can see who observed and when.

Also for what runs on its own

Automated processes record in the same place, including when they fail. An evidence collector that could not run leaves a trace — the silence of an automation is precisely what nobody notices until they need it.