# Audit log

> Review a chronological record of security- and governance-relevant activity in your organization.

*[View this page in the Flax docs](https://flax-analytics.com/docs/administration/audit-log)*

The audit log records who did what in your organization, giving you an accountability trail for security reviews and compliance. Admins view it under `/app/settings/audit`.

## What is recorded

Flax writes audit entries for security- and governance-relevant events using dotted names, such as `login.password.success`, `resource.shared`, `attribute.set`, and `user.deleted`. Each entry captures:

| Field | Description |
| --- | --- |
| Actor | The user who performed the action. |
| Organization | The org the event belongs to. |
| Event | The dotted event name. |
| IP address | The client IP the request came from. |
| User agent | The client that made the request. |
| Metadata | Event-specific details, where relevant. |
| Timestamp | When the event occurred. |

## Reviewing activity

Open the Audit page to browse entries newest-first. Use it to answer questions such as who shared a dashboard, when SSO settings changed, or which account was deleted.

> [!NOTE]
> Audit entries are written before destructive actions complete — for example, an account deletion is logged while the actor's identity still exists — so the trail stays intact even after data is anonymized.

## Related

- [Security](/docs/administration/security)
- [Sharing and permissions](/docs/administration/sharing-and-permissions)
- [Privacy and GDPR](/docs/administration/privacy-gdpr)