Workspace activity log (audit trail)

What it is

Settings → Activity log lists everything that happens in the workspace as plain sentences, newest first, grouped by day — for example “Husam Daoud renamed the workflow 'QA Fetch' to 'Fetch orders'”, “A schedule started Daily digest (run 3f9a1c2b)” or “Sam Lee was invited as Viewer by Husam Daoud”. Click a row for the details: what changed (before and after), a link to the workflow, member or setting it's about, the person or system that did it, the country the request came from, the browser family and a request ID you can quote to support.

Not the same as Activity (runs)

The Activity page in the sidebar shows workflow runs only. The activity log in Settings records every kind of change in the workspace, including runs.

Who can see it

Only workspace owners and admins. Other roles see a message saying the log is for owners and admins. Opening it, filtering it and exporting it all check your role on the server.

What's recorded

Type	Events
Workflows	Created (blank or from a template), edited (with a summary such as “added 2 steps (Router, Slack), changed settings on 'AI qualify' (model, prompt)”), renamed, deleted; versions saved, restored and deleted.
Runs	Started (manually, by a schedule, by a webhook, or resumed after a review) and finished: succeeded, failed (with a short error), paused for review, cancelled. Dry Runs aren't recorded.
Reviews	Approved, rejected, edited and approved, assigned, and timed out.
Schedules & webhooks	Activated, updated, paused, resumed, deleted, and webhook secret rotated.
Credentials & integrations	Credentials added and revoked; integrations connected, reconnected, disconnected or changed; failed connection attempts; a stored credential rejected by the service during a test (at most once every 10 minutes per credential).
AI providers	Connected, key replaced, tested (passed or failed), removed, and keys rejected by the provider during runs (at most once every 12 hours per provider).
Members	Invited, invite resent or revoked, joined, role changed, removed, left.
Workspace settings	Workspace created; name, industry and timezone changes with before and after; billing details changes (the tax ID is masked, e.g. ••••1234).
Billing	Plan and billing interval changes, add-ons (extra seats, workflow pack), cancellation and resumption, the subscription ending, failed payments, agents bought, unlocked or removed. Changes made in the Stripe billing portal are recorded as “via Stripe”.
Data & exports	Workspace data exports, and exports of the activity log itself.
Security	API keys created or revoked (including “revoke all”), the first time each person opens the workspace each day, and refused attempts: someone whose role doesn't allow an action trying it anyway, or someone outside the workspace trying to use it (at most one entry per person and action per minute).
API	API key use (at most once per key per hour), rejected API requests (wrong secret, expired or revoked key, missing scope, rate limited — at most once per key and reason per hour), and outbound webhooks added, changed, removed, secret rotated, or turned off automatically after repeated failures. Runs started through the API show the key's name.

How workflow edits are summarised

The canvas saves every few seconds, so edits are grouped: your first change is recorded straight away, and further changes you make to the same workflow within 10 minutes are combined into one entry (written when you next save after the 10 minutes, when someone else edits the workflow, or when the log is opened). Moving steps around isn't a change. Renames are always recorded on their own.

What's never recorded

Secrets: API keys, tokens, passwords, webhook secrets and credential values.
Prompts and other free-text settings: the log says “prompt changed”, not what it says. Only short, harmless setting values such as the model name are shown.
Run inputs and outputs, and webhook payloads.
Your IP address: only the country and a salted, one-way hash (so repeated requests from the same address can be matched without storing it).

Filters, search and export

Filter by date range, person (or schedule, webhook, API key), type, workflow and severity, or search the sentences. Scroll to load older entries. Export CSV downloads everything matching the current filters (up to 50,000 entries), with the time in UTC, the sentence, the event code, who, what it was about and the details. Cells that a spreadsheet could treat as a formula are prefixed with an apostrophe. Each export is itself recorded in the log.

How long it's kept

Plan	Kept for
Free	30 days
Basic	90 days
Pro	1 year
Business	2 years
Elite	2 years
Enterprise	Set per contract (3 years by default)

Older entries are deleted every night. If you move to a plan with a shorter period, entries older than the new period are deleted the next night; moving to a longer period doesn't bring back entries that were already deleted.

Can entries be changed?

No. The log is append-only: the database rejects edits and deletions of entries. Entries leave the log only through the nightly retention clean-up or when the workspace itself is deleted.