Activity Logs
Understanding the comprehensive audit trail and how to use it for compliance and investigation.
What Gets Logged
The activity log captures every significant event in your organization: authentication events (sign-in, sign-out, failed sign-in attempts), data creation (new work orders, handoffs, NCRs, stations), data modifications (status changes, quantity updates, role changes, setting modifications), data deletions (when permitted by role), and administrative actions (user deactivation, invite generation, plan changes). Each log entry includes: the user who performed the action, a timestamp, a description, and relevant metadata.
Searching and Filtering
The log can contain thousands of entries. Use the filter controls to narrow your view: by User (show only actions by a specific person), by Activity Type (e.g., only authentication events, or only work order changes), by Date Range (from/to date picker), and by Team (show only actions related to a specific team). Filters can be combined — for example, show all NCR filings by user "Jane Smith" in the past 7 days.
Data Access Logs
A separate, more granular log tracks data access: which users viewed or queried which records. This is important for organizations with compliance requirements (ITAR, HIPAA, SOX) where you must demonstrate who accessed sensitive data and when. Data access logs include the table name, record ID, operation type (SELECT, INSERT, UPDATE, DELETE), and user identity.
Exporting Logs
Both activity logs and data access logs can be exported as CSV files for external analysis, archival, or auditor review. Click the export button and select the date range and log type. Exports include all entries matching your current filters, so you can generate focused reports (e.g., all authentication events for the past quarter).
Log Retention
Activity logs are retained for the lifetime of your organization. They cannot be deleted or modified by any user, including Admins. This immutability ensures the integrity of the audit trail — you can always trace back to who did what and when, regardless of subsequent changes.
Investigating Incidents
When something goes wrong — an unexplained work order status change, a data discrepancy, or a suspected unauthorized access — the activity log is your primary investigation tool. Start by identifying the affected record (work order number, station ID, etc.), then filter the log for that record to see all related events in chronological order. This typically reveals who made the change, when, and what the previous value was.