Admin — Audit Log

A complete, tamper-evident record of every significant action taken in your workspace — who did what, to which entity, and when.

What is logged

• Feature and Story create, update, delete
• Status changes (with before/after values)
• Sprint creation, start, and close
• User invite, deactivation, and role changes
• Admin settings changes (security, access matrix, branding)
• Integration connect, disconnect, and sync errors
• WSJF score overrides
• Security events: login, logout, MFA, SSO, RBAC changes

Filtering the log

Filter by entity type (Feature, Story, Sprint, User, security, etc.), action, actor, or free-text search. Combine filters for forensic investigation of a specific incident.

Log entry detail

Each entry shows: timestamp, actor name, action type, entity type, entity name/ID, and a field-level diff for updates (e.g. Status changed from "Backlog" → "In Progress"). Security events include a human-readable message.

Export

Export the filtered log as CSV or JSON (up to 10,000 rows). Use Export for SIEM for Splunk, Microsoft Sentinel, or similar tooling — generates a time-limited download link. Exports are logged in the audit trail.

Retention

Set Audit log retention (days) on Admin → Security (default 365, minimum 90). Organisation policy may set the baseline for all member workspaces. Entries expire via server-side TTL.