Audit log

Every mutating action taken in your organization - by a person or by an automated process acting on your behalf - is written to an append-only audit trail. This page covers what’s recorded, how to get it out of Sencai, and who can see it.

What’s recorded

Each audit entry captures, at minimum:

• Action - what happened (for example, an organization setting being changed, or a cloud instance being created)
• Actor - who did it, and which organization they were acting as
• Resource - the type and ID of the thing that was affected
• Changes - what changed, where applicable
• Risk level - a rough severity classification Sencai assigns to the action
• Correlation ID - links related entries from the same request together
• IP address and user agent of the request that triggered it
• Timestamp

Both actions your team takes directly in the app and actions the platform takes on its own (a scheduled scan completing, an automated remediation firing) are recorded - not just interactive clicks.

Tamper-evidence

Each entry’s stored hash includes the previous entry’s hash, so the audit trail forms a chain: altering or deleting a past entry breaks the chain from that point forward, which is detectable. Entries themselves are retained indefinitely and cannot be deleted or edited, by anyone, including Sencai - the database enforces this.

There’s no self-service “verify chain” button in the app today. If you need an independent chain-integrity verification as part of a compliance audit or investigation, ask your account team.

Exporting your audit trail

There’s no live, in-app search screen for the raw audit log today - the way to work with it is Settings → Audit Export (/gravity/settings/audit-export), which produces a downloadable CSV or JSON file.

1. Choose a date range (defaults to the last 30 days).
2. Optionally narrow it with filters: Action (for example, organisation.update), Resource type (for example, cloud-instance), and Risk level.
3. Pick a format - CSV or JSON - and request the export.

Exports up to 10,000 rows complete immediately; larger exports (up to 100,000 rows) process in the background - the export history list on the same page shows status and refreshes automatically while a job is running.

Note

Export files are available to download for 7 days, then expire. If you need the same data again later, request a fresh export rather than trying to recover an expired one.

Who can read audit entries

Any member of your organization can request an audit export today. Beyond exporting, Sencai’s role model designates Owner, Admin, and Auditor as the roles with direct read access to the audit trail - Auditor exists specifically to give someone (an internal compliance lead, or an external auditor you invite) visibility into what happened in your organization without giving them the ability to change anything. See Roles for how Auditor compares to the other roles.

Retention

Audit entries themselves have no expiry - once written, they’re kept permanently and can’t be purged, either by your team or by Sencai. What does expire is a given export file (7 days, as above); the underlying data it was generated from does not.

What’s next

• Roles - Owner, Admin, Member, Auditor, and Viewer, and what each can do
• NIS2 - how audit evidence feeds into NIS2 compliance reporting
• Access management - every access decision described there is also recorded here
• Security overview - the rest of Sencai’s security screens