Audit Log

The Audit Log provides a complete, tamper-resistant record of every significant action taken in your workspace. It tracks who did what, when, and what changed, essential for compliance, troubleshooting, and accountability.

URL: /settings/audit
Required permission: audit.view

Accessing the Audit Log

1. Go to Settings from the sidebar.

2. Click the Audit Log card (described as "Action history across workspace").

What Gets Logged

concorbit logs all CRUD (Create, Read, Update, Delete) operations across the workspace. Every log entry records:

Action Types

Entities Tracked

The audit log covers all major entities, including but not limited to:

• CRM: Contacts, Companies, Deals, Tasks, Appointments

• Billing: Invoices, Credit Notes, Products, Subscriptions, Payments

• Email: Campaigns, Templates, Email sends

• Vault: Folders, Secrets (including reveal events)

• Docs: Pages, published/unpublished events

• Portal: User invitations, login events

• Settings: User management, role changes, workspace settings, brand changes, SMTP configuration

• Files: Upload, deletion

• System: Login, logout, MFA events, API token creation/revocation

Viewing the Audit Trail

The audit log displays as a paginated table showing the most recent entries first. Each row shows the timestamp, user, action badge, and model type.

Viewing Entry Details

1. Click View on any row to expand the detail panel.

2. The detail panel shows:

Previous Values

For update and delete actions, the Previous Values panel shows the field values before the change, displayed as formatted JSON:

{
  "name": "Jane Smith",
  "email": "jane@oldmail.com",
  "phone": "01onal 555 0100"
}

New Values

The New Values panel shows the field values after the change:

{
  "name": "Jane Smith",
  "email": "jane@newmail.com",
  "phone": "+44 20 1234 5678"
}

By comparing old and new values, you can see exactly which fields changed and what they changed to.

IP Address

The IP address of the user who performed the action is shown at the bottom of the detail panel.

1. Click Hide to collapse the detail panel.

Filtering the Audit Log

Use the filter bar at the top of the page to narrow down entries:

Action Filter

Select from the dropdown to show only specific action types:

• All: show everything

• Created: only new record creation

• Updated: only modifications

• Deleted: only deletions

• Viewed: only view/reveal events

• Exported: only export events

Model Filter

Type a model name (e.g., "Contact", "Invoice", "User") to filter entries to a specific entity type. This is a free-text field that matches against the model type.

Date Range

Use the From and To date pickers to restrict the log to a specific time period. Leave either blank for an open-ended range.

Applying Filters

1. Set your desired filters.

2. Click Filter to apply.

3. Click Clear to reset all filters and show the full log.

Filters are applied via URL parameters, so you can bookmark a filtered view or share the URL with colleagues.

Pagination

The audit log is paginated to keep the page responsive. The bottom of the table shows:

• Total entries matching the current filters.

• Page navigation buttons to move between pages.

The current page is highlighted. Click any page number to jump to it.

Exporting Audit Data

To export the audit log as a CSV file:

1. Optionally set filters to narrow the export (action type, date range).

2. Click the Export CSV button in the top-right corner.

3. A CSV file downloads containing all entries matching the current filters.

The exported CSV includes the timestamp, user name, action, model type, and model ID for each entry. (The old/new value detail and IP address shown in the on-screen detail panel are not included in the CSV.) This is useful for:

• Compliance audits: provide a complete activity record to auditors.

• Incident investigation: export a time-bounded log around a specific event.

• Record keeping: maintain offline copies of your activity history.

Understanding Old Values and New Values

The old_values and new_values fields are JSON objects containing only the fields that changed (for updates) or the full record (for creates and deletes).

For "Created" Actions

• old_values is empty or null.

• new_values contains the initial field values of the new record.

For "Updated" Actions

• old_values contains the previous values of changed fields only.

• new_values contains the new values of those same fields.

• Unchanged fields are not included.

For "Deleted" Actions

• old_values contains the full record at the time of deletion.

• new_values is empty or null.

For "Viewed" Actions

• Typically neither old nor new values are recorded. The log entry simply records that the record was accessed.

• For vault secret reveals, the log may record which secret was revealed (by ID and name) without including the secret value itself.

For "Exported" Actions

• new_values may contain metadata about the export (e.g., the type of data exported, the number of records, the file format).

Audit Log Retention

Audit log entries are retained indefinitely for the lifetime of your workspace. They are not affected by the trash retention period and cannot be deleted by workspace users.

Security Considerations

• Audit entries are append-only. They cannot be edited or deleted by any user, including workspace owners.

• System actions are logged even when no human user is involved (e.g., automated subscription renewals, scheduled email sends).

• Support access sessions are logged separately in the Support Access page, but actions taken during a support session also appear in the main audit log.

• IP tracking provides an additional layer of accountability for forensic analysis.

Common Use Cases

"Who changed this contact's email?"

1. Filter by Action: Updated and Model: Contact.

2. Find the entry with the contact's name.

3. Expand the detail to see old and new email values.

"Who deleted this invoice?"

1. Filter by Action: Deleted and Model: Invoice.

2. Find the entry by date.

3. Expand to see the full invoice details at the time of deletion.

"What did a specific user do this week?"

1. Set the From date to the start of the week.

2. Scan the User column for the person's name.

3. Alternatively, export the filtered CSV and search in a spreadsheet.

"Has anyone accessed the vault secrets?"

1. Filter by Action: Viewed and Model: VaultSecret.

2. Review who accessed which secrets and when.

Related Documentation

• Roles & Permissions, controlling who can view the audit log.

• Security & Authentication. MFA and session management for accountability.

• User Management, correlating audit entries with user accounts.