Security audit log

Use the security audit log to investigate sign-ins or changes to organization access. Events show the action, with actor, target and request details where available.

Reading and exporting the log requires the Business plan or above and audit:read.

1. Open the organization name in the sidebar, then select Organization Settings > Security audit log.
2. Use Any actor or Any action to narrow the list. Set the date fields to limit the period, or select Clear to reset the filters.
3. Expand an event with its chevron to inspect USER AGENT and METADATA. The table also shows Time, Actor, Action, Target and IP address.

Events appear newest first. Select Load more to read older matching events. Editor and Viewer roles don't include audit access; an administrator can grant it through a custom role.

Export matching events

Select Export CSV or Export JSON after setting the filters. The export includes every event that matches the filters, including ones you haven't loaded in the table.

Each export is capped at 10,000 rows. If it's truncated, ArchDocs shows a notice. Narrow the date range and export again. Exporting the log also creates an audit event.

Retention

Business retains audit events for 90 days; Enterprise retains them for 365 days. Older events are removed by a nightly purge. Export records you need to keep beyond the retention window.