Logging & Audit

​

Audit Event Types

• Authentication: Logins, logouts, MFA events
• Authorization: Permission changes, role updates
• Data Access: Data reads, exports
• Configuration: Settings changes, SSO updates
• Security: Break-glass, suspicious activity

​

Audit Log Retention

• Standard: 1 year
• Compliance: 7 years (configurable)
• Immutable: Logs cannot be modified or deleted

​

Audit Log Access

• API: /api/v1/tenants/{id}/audit
• Export: CSV or JSON format
• Real-time: Webhook events

​

Compliance Standards

• SOC 2: Security and availability controls
• ISO 27001: Information security management
• GDPR: Data protection and privacy
• HIPAA: Healthcare data protection

​

Best Practices

• Review audit logs regularly
• Export logs for compliance
• Set up alerts for critical events
• Monitor for suspicious activity
• Retain logs per compliance requirements