Audit log

The audit log records what was done, by whom, and when. It is under Audit log in the panel.

What is recorded#

Actions against servers, projects, databases, domains and team membership — deploys, rollbacks, deletions, permission changes, approvals and rejections, and terminal sessions.

Two details worth knowing because they change what you can rely on:

• Deletes are recorded before they happen. If a deletion fails halfway through, the record of who asked for it still exists.
• Removing a project record and tearing it down on the server are logged separately, because only one of them takes something offline.

Reading it#

Filter by actor, action or time range to answer a specific question. The log is most useful when you arrive with one — "who deployed at 14:20 yesterday" is answerable; scrolling it to see whether anything looks wrong is not.

Who can read it#

Every built-in role, Viewer included. Seeing what happened is not a privileged action, and a log only some people can read is a weaker control than one everybody can.

What it is for#

Three things, in practice:

1. After an incident — what changed just before it started.
2. Answering "who did this" — without guesswork or blame by recollection.
3. Showing a third party that access is controlled and reviewable.