Review the audit log

The audit log records what happens in your organization: who signed in, who changed a member's role, who created an API key or exported answers, what your SCIM directory did, and every time Polzy staff opened one of your workspaces. Use it to answer "who changed this, and when?", for a security review, or for an auditor.

Open the audit log

Open the account menu at the bottom of the sidebar, choose Organization settings, then Audit log. The newest events come first, 50 to a page; use the arrows under the table to page back in time.

Each row shows:

• When: the date and time of the event.
• Who: the person who acted, with their email address. It can also be Polzy staff, API key, Directory (SCIM), IT setup link with the address the link was sent to, or Not signed in for something like a failed sign-in.
• What: the action in plain words, such as Member role changed, with what it was done to under it.
• Workspace: the workspace it happened in, or Organization-wide for a change to the organization itself.
• Outcome: Done, Refused when Polzy did not allow it, or Failed when it went wrong.

Filter the log

Above the table:

• Person: one or more people, with how many events each has.
• Action: one or more kinds of event, such as Signed in or API key created.
• Outcome: Done, Refused or Failed.
• From and To: a range of dates.

The filters combine. The menus list only the people and actions your log holds.

Open an event

Select a row to open its details:

The request number at the bottom identifies the event if you contact support about it.

What is recorded

• Sign-ins. Signing in and out, sign-in links, password resets, two-step verification set up, turned on or off, and switching workspace.
• People. Members invited, re-roled and removed; contacts added, imported, changed, blocked or deleted; a person's data exported or erased.
• Security. Sign-in rules changed, single sign-on domains and connections, setup links, Require SSO, the SCIM token and every change your directory made.
• Settings and keys. Workspace settings and capabilities, AI settings, translations, API keys, webhooks and integrations.
• Data out. Responses, contacts and the organization's data exported, and the audit log itself exported.
• Billing. Plan changes, add-ons, payment method, invoices paid, cancellation and resuming.
• Safety. Every time a safety signal or its conversation is read or acted on.
• Ask Polzy. Each change Ask Polzy made after you approved it, named after the action.

Polzy never writes a password, a key, a token, a one-time code or what people wrote into the log: those are replaced with [redacted] before an event is saved.

Polzy staff

When Polzy staff open one of your workspaces as an admin, to help with a support request for example, the log records Polzy staff opened the workspace as admin and Polzy staff left the workspace. Everything they do in between appears under Polzy staff, marked Opened as admin by Polzy staff. Such a visit lasts an hour at most. When staff look at a person or a workspace's logs from Polzy's own tools, that is recorded too, such as Person viewed by Polzy staff (masked).

Export to CSV

Choose Export CSV to download the events that match your filters, as a file named audit-log- and the date. Times are in UTC. The file has one column per detail: time, workspace, who acted and how, the action, what it was done to, the outcome, the IP address, the browser, the request number and the fields changed. Exporting is itself recorded, as Audit log exported.

How long events are kept

The line above the table says how long: Polzy keeps events for 400 days, then deletes them automatically. Nobody, at your organization or at Polzy, can edit or delete an event before then. To keep events longer, export them regularly.

Troubleshooting

• The audit log could not be loaded. Try again in a moment. Choose Try again.
• The audit log could not be exported. Try again, or narrow the dates. A very long range can take a while: export it in parts with From and To.
• No events match these filters. Clear a filter, or widen the dates.
• The tab shows a lock. Your plan does not include the audit log, or this workspace switched it off. See What a workspace does.