Audit Log
See who did what in your Better Analyst team workspace, filter activity by person, type, and date, and export it to CSV for security reviews.
The audit log is a record of security-relevant activity in your team workspace. Team Owners and Admins can open it from Team settings → Audit log. It is included with the Business plan and with custom contracts.
Entries can't be edited or deleted, and they're kept even if the team is deleted.
What is recorded
| Category | Activity |
|---|---|
| Sign-in and security | Every sign-in to the team's members' accounts (password, Google, magic link, SSO, the Excel add-in, and the ChatGPT plugin), two-factor authentication turned on or off, new recovery codes, sign-ins with a recovery code, Better Analyst support sessions starting and ending |
| Team and members | Team created, renamed, or deleted, invites sent, resent, revoked, or accepted, join requests approved or declined, role changes, members removed or leaving, ownership transfers |
| Billing | Seat count changes, plan changes (in the app or the billing portal), subscription ended |
| Data sources and access | Data sources connected, renamed, reconnected, or deleted; a Google, Airtable, or Power BI sign-in that data sources use removed; database writes turned on or off; data access rules changed, including row rules, tables and columns limited by member, and who sees everything, whether an owner, an admin, or the source's access manager made the change; row rule previews (Preview as member); dashboards viewed as a member and test chats started as a member (View as a member); changes to who manages access to a data source; member attribute fields added, changed, or removed; a member's attribute values changed |
| Sharing and publishing | Work shared into the team, dashboards, chats, reports, and charts made public or private, dashboard changes published, dashboard and chart exports, embed signing keys rotated |
| SSO and provisioning | SSO sign-ins, identity provider and domain changes, sign-in requirement changes, enterprise security included in or removed from your contract, provisioning tokens, members provisioned, updated, or deprovisioned |
| Deleted content | Dashboards, files, and chats deleted |
| Data Context | Data Context published, suggestions accepted or rejected |
| Projects | Projects created, changed, or archived; a project's data sources changed; chats and other items moved between projects; who can see a project and its members changed; a data source made project-only or not; automations paused in a private project (Private projects) |
| Slack | Slack connected, disconnected, or settings changed; Slack accounts linked or unlinked |
| Audit log | Audit log exports |
When Better Analyst support signs in to help with a member's account, the entry shows the support person and is labelled Better Analyst support.
Each entry records the time, the person, what they did, what it applied to (for example, the data source's name), and the IP address the request came from.
The log covers actions taken in the Better Analyst app, its add-ons, SCIM, and Slack. Sharing changes and deletes are recorded by the database itself, so they're logged however they're made.
The log records identifiers and names only. It never stores your data, query text, file contents, or credentials. Data access rule changes record how much was restricted (for example, the number of row rules), not the rule values. Member attribute changes record which fields changed and how many values were set, and row rule previews record whose rules were previewed, never the values themselves.
Filtering and export
Filter by activity category, person, and date range. Times in the app are shown in your time zone.
Export CSV downloads the entries that match your current filters, newest first, up to 100,000 rows. Times in the export are in UTC. Every export is itself recorded in the log.
Plans
Activity is recorded for every team. If your team is on Max, upgrade to Business to view and export it; history from before the upgrade is included.