Audit Logs

The audit log is your sub-account’s record of significant actions: who did what, and when. When you need to answer “who changed this?” or confirm whether an account was accessed, the audit log is where you look. It turns vague suspicions into clear, timestamped facts.

The audit log records who changed what and when across your sub-account.

What’s recorded

The audit log captures meaningful events along with the user responsible and the time it happened. Typically this includes:

• User logins (and, depending on the event, sign-in details)
• Changes to settings and configuration
• Records that were created, edited, or deleted
• Other significant administrative actions

Each entry generally shows three things: who performed the action, what the action was, and when it occurred.

Note

The audit log is a record of actions, not a full backup. It tells you that something changed and who changed it — it isn’t a substitute for exporting or backing up your data.

Reading and filtering the log

1. Open the audit log under your sub-account’s settings (often Settings → Audit Logs).
2. Scan the list, which is usually ordered with the most recent events first.
3. Use the available filters to narrow the view — for example, by user, by date range, or by action type.
4. Open an individual entry, where available, to see more detail about what changed.

Tip

When investigating something specific, filter first. Narrow to the user and the day in question before you start reading, so you’re scanning a handful of relevant entries instead of pages of unrelated activity.

When to use the audit log

The audit log earns its keep in a few recurring situations:

Situation	How the log helps
”Who changed this setting?”	Find the user and time behind a configuration change
Something was deleted	See who removed it and when
Security review	Spot unfamiliar logins or unexpected activity
Troubleshooting a sudden change	Trace what action caused the behavior you’re seeing
Accountability	Confirm who took a sensitive action

Tracing a change

When something looks different and no one’s sure why, work backward:

1. Note roughly when the change appeared.
2. Filter the log to that time window.
3. Look for actions matching the affected setting or record.
4. Identify the responsible user, then follow up directly.

This turns “I think the settings changed somehow” into “this was edited Tuesday at 3:14 PM by a specific person,” which makes the conversation — and the fix — far easier.

Security reviews

Periodically reviewing logins is a healthy habit, especially for accounts with access to customer data. Look for sign-ins at unusual times or from unfamiliar patterns. If you spot something concerning, have the affected user change their password and confirm two-factor authentication is enabled.

Caution

If you find evidence of unauthorized access, act quickly: reset the affected passwords, enable 2FA, and review what the account could have changed. The audit log helps you scope exactly what was touched so your response is focused.

Good habits

• Check the log when something unexpected changes, before assuming a bug.
• Use it to coach, not just to catch — most “who did this” answers are honest mistakes worth a quick conversation.
• Combine it with strong access practices: fewer admins, individual logins, and 2FA make the log clearer and your account safer.