The Audit Trail

What is recorded

Settings → Audit Trail records everything people do in your workspace:

• Every record added, edited or deleted in every module: companies, contacts, tickets, projects and tasks, invoices, employees, devices, policies, automations, settings, roles and more.
• Exactly which fields changed, with the value before and after. Linked records are shown by name, not ID, for example Assigned to: Sam Taylor → Alex Morgan.
• A full copy of every deleted record, so it can be looked at or restored later.
• Bulk changes, with how many records they touched.
• Sign-ins: successful and failed sign-ins, MFA checks, password changes and resets, and client portal sign-ins.
• Refused and failed actions: someone trying to do something their access does not allow is recorded as Refused.
• Exports and downloads of data from the platform.
• New agents, devices and security enrolments, even when a machine rather than a person creates them.

Each entry says who did it (name, email and role), when, from which IP address and device or browser, and whether it was a staff user, an API key or a client portal user.

What is never stored

Passwords, tokens, API keys and other secrets are never written to the audit trail. The entry says Secret value changed instead. Encrypted fields, such as employee bank details, stay encrypted in the trail and show as protected.

Reading an entry

Each row is written as a sentence, for example Updated Project "Office move" — Status: Planning → Active. Click any row to open it:

• What changed: a table of every field, before and after.
• Done in the same action: everything else that one click changed, such as a deal and the tasks it created.
• Full history of this record: every change ever made to it, oldest to newest.
• Technical details: request path, response code, request ID and how long it took.

Click a person's name to see everything they did. Click an IP address to see everything done from it.

Filters

• Time frame: last hour, 24 hours, today, yesterday, 7, 30 or 90 days, all time, or a custom range to the minute.
• Person: search by name or email.
• Module, record type and action (created, updated, deleted, bulk, sign-ins, exports, reverted).
• Category (business data, configuration, security and policies, users and access, sign-in, exports), outcome (succeeded, failed, refused) and severity.
• Under More filters: source, IP address, record ID, request ID and sort order.
• Search matches record names, people, emails, paths and IDs.

Choose which columns to show with the Columns button. You can add role, request ID, path and device/browser for deeper investigations.

Exporting

Export CSV or JSON downloads everything matching your current filters, up to 50,000 entries per export. The CSV opens directly in Excel and includes the field changes in plain text. To export more, narrow the date range and export in parts.

Undoing a change

Administrators can undo changes from the trail. See Investigate and undo a user's changes.

Who can see it

Administrators and HR administrators can view the trail. Only administrators can undo changes. Entries can't be edited or deleted by anyone: a trail that can be changed proves nothing.

Good to know

• Changes made directly to your company's master account settings (for example your subscription) show as the action taken, without a field-by-field breakdown.
• When deleting a record also removes records that belong to it, the audit trail keeps a full copy of the main record only.
• Remote-control and terminal sessions on devices are recorded in the device's own session log in RMM.