Skip to content

Audit Logs

Audit logs keep a running record of the significant actions taken in your account. They exist to answer four simple questions about any change: who did what, when, and from where. When something looks wrong — a setting changed, an inbox deleted, a role altered — the audit log is where you find out how it happened.

Where to find them

Go to Settings → Audit Logs. Each entry is listed under three columns:

  • Activity — a plain-language description of what happened.
  • Time — when it occurred.
  • IP address — where the action originated.

Scroll or page through to find what you need.

Tip

Use your browser's find shortcut — ++ctrl+f++ (or ++cmd+f++ on macOS) — to jump straight to an entry on the current page.

What gets logged

An entry is recorded, with a timestamp and IP address, whenever one of the following happens. Placeholders like Name | Email are filled in with the actual person and target.

User activity

  • A user changes their own status to online, offline, or busy.
  • A user signs in or signs out.
  • A user changes another user's availability status.
  • A user invites someone as an agent or admin.
  • A user changes another user's role.

Account activity

  • A user updates the account configuration.

Automation rules

  • An automation rule is created, updated, or deleted (with its rule ID).

Macros

  • A macro is created, updated, or deleted (with its macro ID).

Inboxes

  • An inbox is created, updated, or deleted (with its inbox ID).
  • Members are added to or removed from an inbox.

Webhooks

  • A webhook is created, updated, or deleted (with its webhook ID).

Teams

  • A team is created, updated, or deleted (with its team ID).
  • Members are added to or removed from a team.

Common questions

Can audit logs be edited or removed? No. They are an immutable record by design — that is what makes them trustworthy for investigations and compliance.

Why does the IP address matter? It helps you confirm whether an action came from an expected location. An unfamiliar IP behind a sensitive change is a useful early warning sign worth following up.