Audit log
Every state-changing action across your organisation, recorded as it happens.
What gets recorded
Every write is an insert — the application never updates or deletes a record once written. That is application discipline today, not a database-enforced guarantee: there is no cryptographic signing and no hash chain linking records, so treat the log as a reliable operational record, not as tamper-evident evidence on its own.
- PR analysis completed, or blocked by policy
- Policy created, updated, or deleted
- Repository enabled or disabled, API token issued or revoked
- Incident status changed, org notification or AWS settings updated
Availability
There is nothing to enable — the actions above are recorded automatically for every organisation, with no configuration file or opt-in step. View the log in the dashboard under Settings → Audit log, or in the sample below.
Record shape
Every record has the same six fields. `payload` varies by action and is never redacted for you — it can contain your own configuration values, so treat exports accordingly.
{
"id": "3f9b7c2a-...",
"actor": "api",
"action": "repo.enabled",
"target": "9c1a4e70-...",
"payload": { "full_name": "acme/platform" },
"created_at": "2026-07-21T10:04:11Z"
}DriftGuard is early access. The dashboard view paginates 100 records at a time; the "Export CSV" button downloads up to the 500 most recent records in one file. Treat the log as supporting evidence for your change-management process, not as a certified compliance artifact on its own.