Review the audit log

The audit log is a permanent record of who did what in your organisation. Use it to answer 'who changed this donor', 'when was that role granted', or 'who revoked that API key' - with the actor, outcome, and time for every event.

Together records an audit event for every state change and security event in your organisation: donor and donation edits, settings and user changes, API-key and webhook changes, sign-ins, and password or MFA changes. The record is append-only - events can't be edited or deleted - so it stands up as evidence long after the fact.

The audit log is on the Compliance add-on and the Enterprise plan. If you don't see it under Settings, an ADMIN can add it from Settings -> Billing. Recording happens for every organisation from day one; the add-on unlocks the ability to read it back.

Before you start

You need:

The ADMIN role on your organisation.
The Compliance add-on or an Enterprise plan.

Open the log

Go to Settings -> Audit log. Events are listed newest first, showing:

When. The time the event happened, in your organisation's timezone.
Actor. Who did it (a team member's email, or a system source like a Stripe webhook or a CRM sync), plus where it came from.
Action. What happened, as a short code such as donor.updated, apikey.created, or settings.updated.
Target. What was acted on (a donor, a donation, an API key).
Outcome. A green Success, or a red badge naming why it failed (for example not_found or dispatch_failed).

Both successes and failures are recorded, and both people and automated systems appear as actors - a staff member's edit and a webhook-driven donation sit in the same timeline.

Filter the list

Three filters narrow the view, and they combine:

Outcome. The pills at the top switch between all events, only Success, or only Failure - a quick way to surface everything that didn't complete.
Action. The dropdown lists every action type. Pick one - say user.role_changed - to see only those events.
Date range. Set From and To to bound the window to a specific day or period. Dates are read in your organisation's timezone, so "1 July" means your calendar day.

Press Apply to run the filters, or Clear to reset. The list paginates 50 events per page.

What the log is - and isn't

It is append-only and permanent: nothing you or your team does removes an event. That's what makes it evidence.
It records failures as well as successes, so an attempt that didn't complete is still visible.
It is scoped to your organisation - you only ever see your own events, never another organisation's. A failed sign-in attempt happens before anyone is identified, so it can't be tied to an organisation and does not appear in this per-org view.
It is not a live activity feed or a place to leave notes. For donor-by-donor context, use the Activity tab on the donor record.

What to do next

Trace a change by filtering to the action and date range you care about, then reading the actor and outcome.
Review failed attempts by switching the outcome pill to Failure - for example a receipt that couldn't send, or a change that was rejected.
Add the add-on if the page shows an upgrade prompt: an ADMIN can subscribe at Settings -> Billing.