Audit Logs

Who changed what, when,
and what it was before

Every change made in Countly, through the dashboard, the API or an AI assistant, is written to one server-wide trail the moment it succeeds: the account, the time, the address, and the values before and after. Nothing in the dashboard can edit or delete an entry.

In this demo deployment, a project’s time zone changed, and the entry says by whom, from where, and what it was before.

Part of data control

The questions a security review
asks, answered from one table

Filter by action and account, open an entry, and export what matches as evidence.

“Who changed this setting, and what was it before?”

Before and afterAn update records the fields that changed with their old and new values, side by side.

“What did this account do before it left?”

One accountEvery action by one person over any period, exported as a file. A deleted account still appears in its old entries.

“Who exported or deleted that person’s data?”

Data requestsProfile exports and deletions are actions like any other, with the account, the time and the profile.

“What did the AI assistant change?”

Tokens and MCPAn action through a token or an AI assistant is recorded against its account, with a line naming the token it came through.

Recorded everywhere

Every feature
writes to the same trail

Each kind of action has its own code, so you can follow one feature, one account or one kind of change across the whole server.

Access

Who signed in, and how.

Sign inFailed sign inToken sign inAPI key retrievedPassword resetSign out

People and permissions

Who can see and do what.

MembersUser groupsProjectsServer settingsFeatures turned on or off

Personal data

Every time someone touched an individual’s record.

Profile exportedProfile deletedProfiles added to a cohortOld data cleared

Engagement

Messages and changes that reach users, with approvals.

Push messagesJourneys and their approvalsVariables and rolloutsExperimentsSurveys

Analytics

The definitions reports are built on.

CohortsFunnelsFlowsDashboardsSaved Drill queriesEmail reportsHooks

AI

Which assistants were connected, and when they were revoked.

MCP connectionsMCP settings

Built to be evidence

A trail you can
hand to an auditor

An audit log is only worth something if nobody can quietly change it.

  1. 01

    Written when it happens

    An entry is written the moment an action succeeds, never filled in later from the current state.

  2. 02

    Never edited

    Nothing in the dashboard edits or deletes an entry, and nothing prunes the trail.

  3. 03

    Admins only

    The trail covers the whole server, and only a global administrator can read it.

  4. 04

    Exported whole

    An export covers every entry matching the filters and period, as CSV, XLSX or JSON.

Works with

Audit Logs, with the
rest of Countly

Every feature reads the same live data, so an answer in Audit Logs doesn’t stop there. These are the handoffs built in.

All features

Data ownership

The record of who touched your data,
kept with your data

The audit trail lives in the same deployment as the analytics it describes, under the same control.

Data privacy
AspectFlexEnterprise
EnvironmentDedicated single-tenant instanceYour cloud, your data center or air-gapped
Data residencyThe Google Cloud region you chooseWherever you deploy, including air-gapped networks
Vendor accessOperated by Countly; access limited, granted by you and loggedNo default access
ISO 27001Certified
ISO 27017Certified
ISO 27018Certified
SOC 2Type II examined
TISAX®Participant*

*Countly Ltd. is a TISAX® Participant. TISAX® is a registered trademark of and governed by ENX Association. Learn more at enx.com/tisax

Try it

Every feature.
One data layer.