Audit trails

Settings → Audit Trails is a record of changes across the workspace: who created, updated, or deleted what, and when. It exists for the questions that come up later: who changed this invoice, when did that role lose a permission, who deleted the account.

Before you start: a role with View audit logs.

What is recorded

Create, update, delete, and bulk update and delete on nearly every kind of record: accounts and their notes, contacts and their account links, leads, opportunities, tasks and comments, tickets and comments, ticket modules, pipelines, documents, quotes, invoices, payments, recurring billing, knowledge base categories, articles and settings, company settings, users, invitations, roles, API keys, working hours, imports, sending and support channels, domain verifications, and quarantined mail.

Each entry shows the action, the record, a summary of what changed with the fields affected, the user who did it, and the time. Changes made by the system rather than a person, such as an hourly job, show System.

Two limits worth knowing:

• Sign-ins are recorded only when they fail. Successful sign-ins are not in the log.
• Entries cannot be edited or deleted, by anyone, including through the database. The log is append-only by design, and there is no retention window yet, so it only grows.

Search it

Search by text, or filter by Entity Type, Action, user, and a date range. Filters combine, and the active ones show as chips above the table. Page size goes up to 100.

When it goes wrong

• A change you know happened is not there. It was made before the audit trail existed, or it is a type that is not audited, such as a read or a sign-in.
• The user column says System. A background job made the change: overdue invoices, recurring billing, or an import.
• You need to remove an entry. You cannot. That is the point of the log.