Operator guide
The audit log
Outcome: you know what is recorded about sensitive actions and how to look it up when you need it.
The audit log is a permanent record of actions that matter for support, security and billing disputes. Rows can be added but never changed or deleted: the database itself refuses an UPDATE or DELETE on the table, so neither the application nor an operator using it can rewrite history.
What is recorded
| Action | Recorded as |
|---|---|
| A workspace is created | workspace.created |
| A member is invited, joins, changes role or is removed | member.invited, member.joined, member.role_changed, member.removed |
| A subscription starts on a new plan | subscription.activated |
| The brand kit is changed | brand_kit.updated |
| A design is imported from JSON | design.imported, design.import_replaced |
| A workspace template is saved | workspace_template.created |
| A test address is added or removed | test_address.added, test_address.removed |
Each row stores who did it (a customer or an operator), which workspace, what was changed, the IP address, the time, and where it helps the value before and after.
Changes to platform settings are kept separately, in platform_settings_audit, with the operator and the full before and after values.
Reading it
The console does not have a screen for this table: Recent activity on the overview lists billing, signup and delivery events across tenants, and Logs shows the application log, which is a different record. Read the audit table with any PostgreSQL client, connected as the database owner (the user in DATABASE_URL, or your hosting panel's database tool):
SELECT created_at, action, actor_type, actor_id, resource_type, resource_id, ip
FROM audit_logs
WHERE workspace_id = 'the-workspace-id'
ORDER BY created_at DESC
LIMIT 50;The workspace ID is shown on the tenant's page in the console, under Account.
Keeping it
The log grows slowly, because it records changes, not page views. Include it in your normal database backups. It is never pruned automatically.
Deleting a user records their email, deleted workspace ids and cancelled subscriptions as user.deleted. The record survives the deletion. Existing tenant audit rows and issued invoices also keep their contents after a sole-owned workspace is deleted; their references to the deleted workspace are detached.