Audit log¶
The audit history answers "who changed what, and when" in your tenant. It is under Settings › Security and access › History.
Who can see it¶
Only the tenant Administrator and the Organization administrator. The Viewer and the Compliance Officer cannot open it (roles).
What it shows¶
The screen lists the 100 most recent events, newest first, with the person who did it (or "the system") and the date and time (Madrid time). The screen has no filters and no export.
It records two families of events:
- Access: sign-ins, failed attempts (with the email and the reason), sign-outs and session revocations.
- Configuration changes: tenant, monitoring and security-policy settings; alert rules and destinations; team members and role changes; API keys (creation, rotation, revocation and denied out-of-scope use); OAuth authorizations of applications; MSSP portfolio keys; the SSO provider; the endpoint agent's employee notice; the pause of agent updates; the observatory and benchmark opt-ins; the HodeiAI switch; and the regulatory scope.
Recording a configuration change is, in general, best effort: if writing the record fails, the change is not blocked.
How it is protected¶
The history is append-only: the application can write new records but cannot modify or delete existing ones. Only the retention process, using its own credentials, removes records, and only when their period has expired.
How long it is kept¶
| Record | Period |
|---|---|
| General audit log | 365 days in the database. Afterwards it is archived in cold object storage and deleted from the database. |
| Record of rights requests from console users (export, rectification, restriction, erasure) | 3 years from the date the request is resolved. After the first year it is blocked (made available only to judges, courts, the public prosecutor and data protection authorities) and, at the end of the third year, its deletion is planned (this is the retention policy). Basis: articles 32 and 72.1.k of the Spanish LOPDGDD. |
| Record of rights requests from your data subjects in the GDPR compliance module | At least 5 years; then archived. It is your organization's data, of which it is the controller, and is kept according to your documented instructions (GDPR art. 28.3). |
Because the screen reads only from the database, an event stops showing there once it moves to the archive.
It is not the Trust Center's log¶
The Trust Center has its own Audit log, a tab of its administration page. It lists the access events of your Trust Center (requested, approved, rejected, revoked, auto-approved, viewed and NDA accepted) and is independent of this history. See Publish your Trust Center.