The audit log
Append-only, readable by owners and admins, exportable and streamable.
Every sensitive action is written down: invitations, role changes, dismissals with their reasons, billing events, exports, repository connections and settings changes. The log is append-only - entries are never edited or deleted.
- Readable in the app by owners and admins.
- Exportable on demand, and on a schedule.
- Streamable to a SIEM for teams that keep one.
This is what answers the questionnaire
When an enterprise customer asks how you track security decisions, the audit log plus your reports is the answer, and it already exists.
Questions
How far back does it go?
To the creation of the organization. It is not rotated.
Can an admin delete an entry?
No. Nobody can, including us. That is what append-only means.
Something here wrong, missing or out of date? Tell us and we will fix the page.