Security audit log in the Admin Center
The Security tab holds the audit log: a read-only record of important events such as sign-ins, role changes and deleted projects. Use it to answer “who changed this, and when?”. It is separate from the activity log on individual tasks.
At a glance
| What it is | Append-only record of organization events |
| Where to find it | Profile picture > Admin Center > Security |
| Who can use it | Owners and Admins. Only the Owner changes retention |
| Plan | All plans |
What do I see on the page?
Summary cards show Events, Failed logins, Permission changes and Retention window. The table has Timestamp, Actor, Category, Event and Details; failed sign-ins carry a FAILED tag.
How do I filter?
- Type in Search actor or event….
- Use Actors to pick specific users.
- Click a category: All, Access & Auth, User & Role, Permissions or Lifecycle.
- Click Clear filters to reset.
What is recorded?
Sign-ins and password events, members invited, removed, updated, activated or deactivated, role and permission changes, ownership transfers, projects created, archived, deleted or restored, workspace renamed or deleted, teams deleted, workspace setting and retention changes, and invitation links.
How do I export?
Click Export to CSV. Large exports run in the background; when ready, click Download CSV. The link works until the date shown, after which you see “This export has expired. Start a new export to get a fresh file.”
How long is data kept?
Between 3 and 24 months, 12 by default. Entries past the window are purged automatically and nobody can edit or delete entries by hand. Admins see “Only the workspace owner can change retention.” The Owner sets it on the Overview tab.
Best practices
- Export before shortening retention, because purged entries cannot be recovered.
- Filter by User & Role after staffing changes, because that category shows who gained or lost access.
- Search for FAILED sign-ins when someone reports being locked out, because they appear with the actor’s name.