Question 1

What is the Activity Log?

Accepted Answer

The Activity Log is a security audit trail that records all important events on your account:

Login attempts (successful and failed)
Password and security changes
Team member activity
Subscription changes
API key management

Use it to monitor account security and track who did what and when.

Question 2

What events are tracked?

Accepted Answer

Tracked events include: login success and failure, logout, password changes, password resets, 2FA enable/disable/verify/fail, recovery code actions, profile updates, email changes, account creation, team member invite/join/remove, permission updates, invitation cancellation, API key creation/deletion, subscription changes, and data exports.

Question 3

What information does each log entry show?

Accepted Answer

Each log entry shows: the action (e.g., Login Success), the user who performed it or System, the time it happened, the IP address, the status (Success or Failed), and additional details when available.

Question 4

How do I filter the activity log?

Accepted Answer

Click the Filters button and select criteria including User, Action type, Status (Success or Failed), and Date Range. Results update automatically. Click Clear all filters to reset.

Question 5

How do I copy the activity log?

Accepted Answer

Apply any filters you want, then click the Copy button. The current page of logs is copied to clipboard in the format: Date | User | Action | Status | IP, one entry per line.

Question 6

How far back does the log go?

Accepted Answer

Activity log retention is custom based on your enterprise agreement: standard retention is typically 1 year or more, extended retention is available for compliance requirements, and unlimited retention is available upon request.

Question 7

What does a failed login attempt mean?

Accepted Answer

A Login Failed entry means someone tried to log in but did not succeed. Common reasons include wrong password, wrong email, account locked after too many attempts, or an incorrect 2FA code. If you see unrecognized failed logins, change your password and enable 2FA.

Question 8

How do I identify suspicious activity?

Accepted Answer

Watch for multiple failed logins (check if IP is familiar), logins from unknown IPs (verify and change password if not you), 2FA disabled unexpectedly (re-enable immediately), unknown team changes (verify with account owner), and API keys created without your knowledge (delete and rotate credentials).

Question 9

What do the colors mean?

Accepted Answer

Green indicates positive actions like login success or 2FA enabled. Red indicates negative or failed actions like login failed or 2FA disabled. Yellow indicates caution events like password changes. Blue indicates neutral general actions. Gray indicates informational events like logout.

Question 10

Can I export the full activity log?

Accepted Answer

Enterprise clients have access to a Copy button for the current page, full export for compliance requirements, and API access for programmatic access to activity data. Contact your account manager to configure export options.

Question 11

Who can see the activity log?

Accepted Answer

Owners and Admins have full access to all activity. Members may see limited activity based on their permissions. Team owners and admins can see activity from all team members.

Question 12

How often is the log updated?

Accepted Answer

Events appear in the activity log in real-time as soon as an action occurs. Click the Refresh button or reload the page to see the latest events. The log does not auto-refresh to avoid disruption while you are reviewing events.

Question 13

What is the 'System' user?

Accepted Answer

Events attributed to System instead of a user email are automated actions including scheduled maintenance tasks, automatic token refreshes, background jobs, and system-triggered security actions. These are normal and not a security concern.

Question 14

Can I delete activity log entries?

Accepted Answer

No, activity logs cannot be edited or deleted. This ensures audit trail integrity, compliance with security standards, and reliable forensic evidence if needed. Logs are automatically removed after your retention period expires.

Question 15

How do I use the activity log for compliance?

Accepted Answer

The activity log supports compliance requirements by providing an audit trail of who did what and when, access monitoring for all login attempts, change tracking for all modifications, IP logging for geographic access patterns, and configurable log retention periods. Contact support for SOC 2, HIPAA, or other compliance needs.