The audit log records every significant action taken within your SendOps organization. It provides a tamper-proof timeline of who did what and when, giving your team the transparency needed for security reviews and compliance requirements.


  The audit log is available on all plans. Your plan determines how far back you can see — check the [retention period](#retention-period) table below for details.


## What gets logged

The audit log captures changes across every area of the dashboard:

| Category | Example actions |
|---|---|
| **Team changes** | Member invited, member removed, role changed |
| **Domain changes** | Domain added, domain verified, domain removed, DNS records updated |
| **Channel changes** | Channel created, channel updated, channel deleted, identity assigned to channel |
| **Template changes** | Template created, template updated, template deleted, template version published |
| **Settings changes** | Organization name updated, notification rules changed, webhook configured |
| **Billing events** | Plan upgraded, plan downgraded, payment method updated |
| **AWS connection** | AWS account connected, AWS account disconnected, CloudFormation stack updated |
| **Template export** | SES templates exported, export downloaded |
| **Ownership transfers** | Transfer initiated, transfer accepted, transfer cancelled, transfer expired |
| **Audience changes** | Contact list created, list or segment edited, contact attribute defined |
| **Automation changes** | Drip workflow created or edited, broadcast composed or sent |
| **Tags & folders** | Tag created, renamed, recolored, or deleted |
| **API keys** | Key created, scopes updated, key rotated, key revoked |

Each log entry includes the following columns:

- **Time** — the exact date and time of the action (displayed in your local timezone).
- **Actor** — who performed the action (see [Who performed the action](#who-performed-the-action) below).
- **Resource** — the type and identifier of the affected resource.
- **Operation** — the type of operation performed (e.g., created, updated, deleted).
- **Summary** — a human-readable description of what was done.

## Who performed the action

Not every change comes from a person clicking in the dashboard. SendOps records the actor behind each entry as one of three types:

- **A team member** — the person who made the change, shown by name and email. This is the most common case.
- **An API key** — a change made through the [SendOps public API](https://developers.sendops.dev) is attributed to the API key that authenticated the request, shown by the key's name and prefix, and tagged with an **API** badge so you can tell automated changes apart from dashboard actions at a glance. This covers writes such as creating contacts or firing a broadcast programmatically.
- **System** — background work that has no individual actor — scheduled jobs, automatic sync, and actions triggered during signup — is attributed to **System**.

You can search the **Actor** field for a team member's name or an API key's name to narrow the log to just their activity.

## Searching and filtering

Use the controls at the top of the audit log page to narrow results:

- **Resource type** — filter by resource type using the dropdown (e.g., team, domain, channel, template, settings, billing).
- **Operation type** — filter by the kind of operation using the dropdown (e.g., created, updated, deleted).
- **Actor search** — search for a specific team member to see only their actions.

Filters combine with AND logic, so selecting a resource type and an actor shows only that actor's actions on that resource type.

## Retention period

Audit log entries are retained based on your plan:

| Plan | Retention |
|---|---|
| **Free** | 7 days |
| **Team** | 90 days |
| **Business** | 1 year |

## Using the audit log for compliance

The audit log helps your team meet common compliance requirements:

- **Change tracking** — demonstrate that all infrastructure changes (domains, channels, AWS connections) are attributable to a specific person.
- **Access reviews** — verify who was added or removed from the organization and when.
- **Incident investigation** — trace the sequence of changes that led to a deliverability issue or misconfiguration.
- **Billing accountability** — see who changed the plan or updated payment details.


  Audit log entries cannot be edited or deleted by any user, including the Owner. This ensures the log serves as a reliable record for compliance and investigation purposes.


## What's next?

- Learn about the eight roles and their permissions in [Team Members & Roles](/team/members-and-roles).
- Manage your personal profile and security settings in [Settings & Profile](/team/account-settings).