---
title: "Audit logs: who changed what, and what it was before"
description: "Every change made in Countly, through the dashboard, the API or an AI assistant, is written to one server-wide trail the moment it succeeds: the account, the…"
url: https://countly.com/feature/audit-logs
last_modified: 2026-11-11
---

Audit Logs

# Who changed what, when, and what it was before

Every change made in Countly, through the dashboard, the API or an AI assistant, is written to one server-wide trail the moment it succeeds: the account, the time, the address, and the values before and after. Nothing in the dashboard can edit or delete an entry.

In this demo deployment, a project’s time zone changed, and the entry says by whom, from where, and what it was before.

Part of data control

## The questions a security review asks, answered from one table

Filter by action and account, open an entry, and export what matches as evidence.

“Who changed this setting, and what was it before?” Before and after An update records the fields that changed with their old and new values, side by side.

“What did this account do before it left?” One account Every action by one person over any period, exported as a file. A deleted account still appears in its old entries.

“Who exported or deleted that person’s data?” Data requests Profile exports and deletions are actions like any other, with the account, the time and the profile.

“What did the AI assistant change?” Tokens and MCP An action through a token or an AI assistant is recorded against its account, with a line naming the token it came through.

Recorded everywhere

## Every feature writes to the same trail

Each kind of action has its own code, so you can follow one feature, one account or one kind of change across the whole server.

### Access

Who signed in, and how.

Sign in Failed sign in Token sign in API key retrieved Password reset Sign out

### People and permissions

Who can see and do what.

Members User groups Projects Server settings Features turned on or off

### Personal data

Every time someone touched an individual’s record.

Profile exported Profile deleted Profiles added to a cohort Old data cleared

### Engagement

Messages and changes that reach users, with approvals.

Push messages Journeys and their approvals Variables and rollouts Experiments Surveys

### Analytics

The definitions reports are built on.

Cohorts Funnels Flows Dashboards Saved Drill queries Email reports Hooks

### AI

Which assistants were connected, and when they were revoked.

MCP connections MCP settings

Built to be evidence

## A trail you can hand to an auditor

An audit log is only worth something if nobody can quietly change it.

- 01 Written when it happens An entry is written the moment an action succeeds, never filled in later from the current state.
- 02 Never edited Nothing in the dashboard edits or deletes an entry, and nothing prunes the trail.
- 03 Admins only The trail covers the whole server, and only a global administrator can read it.
- 04 Exported whole An export covers every entry matching the filters and period, as CSV, XLSX or JSON.
Works with

## Audit Logs, with the rest of Countly

Every feature reads the same live data, so an answer in Audit Logs doesn’t stop there. These are the handoffs built in.

[All features](https://countly.com/platform/features)

Compliance Hub

Every profile export and purge from Compliance Hub appears here with who ran it.

Open

[(Compliance Hub Every profile export and purge from Compliance Hub appears here ](https://countly.com/feature/compliance-hub)

Journeys

Journey submissions, approvals and rejections, with who decided.

Open

[(Journeys Journey submissions, approvals and rejections, with who decided. Open)](https://countly.com/feature/journeys)

Adaptive Variables

Every variable, condition and rollout change, with its before and after.

Open

[(Adaptive Variables Every variable, condition and rollout change, with its befor](https://countly.com/feature/adaptive-variables)

MCP Server

Connections from AI assistants, their revocation, and what each one changed, under the person it acted for.

Open

[(MCP Server Connections from AI assistants, their revocation, and what each one ](https://countly.com/feature/mcp)

Enterprise Access

Sign-ins, failed sign-ins and every change to users, groups and permissions.

Open

[(Enterprise Access Sign-ins, failed sign-ins and every change to users, groups a](https://countly.com/feature/access-control)

Data ownership

## The record of who touched your data, kept with your data

The audit trail lives in the same deployment as the analytics it describes, under the same control.

[Data privacy](https://countly.com/platform/data-privacy)

Aspect Flex Enterprise

Environment Dedicated single-tenant instance Your cloud, your data center or air-gapped

Data residency The Google Cloud region you choose Wherever you deploy, including air-gapped networks

Vendor access Operated by Countly; access limited, granted by you and logged No default access

ISO 27001 Certified

ISO 27017 Certified

ISO 27018 Certified

SOC 2 Type II examined

TISAX® Participant*

*Countly Ltd. is a TISAX® Participant. TISAX® is a registered trademark of and governed by ENX Association. Learn more at [enx.com/tisax](https://enx.com/tisax)