The audit log records access and activity in your workspace. This lets you trace at any time who accessed which data and when — for greater transparency and security.
Search entries
Enter a search term in the search field to filter the entries. For a targeted search, you can combine the following filters:
legalcase — entries for a specific case
id — entries for a specific identifier
entity — entries for a specific object type
action — entries for a specific action
date — entries on a specific date
user — entries by a specific person
location — entries from a specific location
Click a filter chip to add it to the search.
What is recorded
The audit log records not only who opened something, but also how data leaves your workspace. Click the action in an entry to see only that kind of access:
Downloads (
action:DOWNLOADED) — single files and documents, whole collections as a ZIP file, attachments from requests, an export, and dashboards, case history and work impairments saved as a Word or Excel file.Prints (
action:PRINTED) — documents from the PDF viewer, dashboards, case history, notebook and every other printed view.Sharing (
action:SHARED) — an export that is shared or revoked. Showing a share's link and password again is recorded as well.Opening a share (
action:VIEWED) — when someone outside your workspace opens a shared export, that is one entry; downloading the file on top of it adds a second.Access by integrations (
action:DISCLOSED) — when a connected integration reads files or content, the access is attributed to the agent, not to someone on your team.Administration — changes to roles, users and your workspace's settings, as well as access to reports and to the audit log itself.
«Show payload» shows which files and documents an entry concerns, in which format and how many there were.
Some actions happen entirely in the browser, for example printing a document or saving a Word file. The application reports these entries itself and marks them as such; if the connection drops at the wrong moment, such an entry can be missing.
Copying text to the clipboard is not recorded.
Limit the time range
Use the chips to choose whether to show the last 30 days, the last year or the last 2 years.
Following changes to a role
Search for id: followed by the role's key, for example id:tenant:tech. You then see every time this role was created, changed or deleted, with the person and the time. «Show payload» shows which permissions were added or removed and what the title, description and icon were before and after. The roles themselves are under Settings: Roles and permissions.
Following changes to workspace settings, members and dashboards
Every change to the workspace's settings — including a reset, a rename and a copy from another workspace of your organization — every change to a member's role or access, and every change to a dashboard's definition is an entry of its own. «Show payload» opens «Values changed (before → after)»: one row per setting, named by its path, with the value before and after; a value that was cleared shows as «—». A save that changed nothing writes no entry. Entries stay visible for two years.
Browse the entries
The list automatically loads more entries as you scroll down.
💡 The audit log is available to you if you have the corresponding permission for your workspace.