Audit logs: a history of the key actions in your workspace

Audit logs in Deskwoot are an append-only record of the important actions in your workspace. There is no button and no API route to edit or delete an entry, so they answer the question "who did what, and when" without trusting any individual admin not to delete the trace afterwards. Audit logs help with SOC 2 access-control evidence, GDPR Article 28 processor recordkeeping, and any internal incident-response process where you need to reconstruct a sequence of changes after the fact.

What gets logged

These actions write an audit row today:

• Sign in: every successful login, and every time Deskwoot support signs in as one of your users.
• Agents, teams and settings: agent invited, agent removed, the Teammates switch of an agent changed; team created, updated or deleted; changes to who may use the AI assistant in conversations and to requiring 2FA for all members.
• Conversations: conversation changes and status changes, CSAT ratings changed by an administrator, and the bulk actions from the conversation list (status, assign agent or team, priority, label, mute, unmute, mark unread, snooze, delete).
• Orders, refunds and subscriptions: orders cancelled or refunded, refunds issued, fulfillments, address changes, returns and cancelled subscriptions, whether an agent or the bot did it, plus bot actions that had to be rolled back.
• Integrations and MCP: integrations connected and disconnected; MCP access switched on or off, MCP tokens created or revoked, and every MCP tool call that changes something.
• Contacts: contacts blocked or unblocked, and email bounces cleared so campaigns reach the address again.
• Privacy and legal: data subject requests (data export sent, erasure carried out), changes to what the bot may do, and the accepted data processing agreement.
• Translation charges: every Help Center article translation that was billed against the prepaid balance, and its refunds.
• Plan changes: campaigns or automation rules paused because the plan no longer includes them, and campaigns stopped because their audience was invalid.

Role changes, personal 2FA and password changes, billing changes and edits to automation rules, macros or canned responses are not in the audit log.

What each log entry contains

One audit row carries: the date and time, the user who acted (or System when Deskwoot itself acted), the action, the type and ID of the target, and the details of the action as JSON, for example the email of an invited agent or the old and new value of a changed setting. It also notes whether the action came from a signed in session or an API token, and which token. Entries don't store the IP address or the browser.

Why "immutable"

Audit log rows have no edit or delete path in Deskwoot. Even an Administrator can't redact an entry: there's no UI button and no API route. If you erase a contact's personal data for a GDPR request, Deskwoot replaces the details of the audit entries that mention them with an erasure marker while the entries themselves stay. So the record of what happened survives even when the personal data is removed.

Searching and exporting

In Settings > Audit Logs the newest entries come first, 25 per page. Filter by action narrows the list to Create, Update, Delete, Login or Export. There is no filter by user or date and no CSV export.

Webhook stream for SIEM

There is no webhook for audit events today, so audit logs can't be streamed to a SIEM (Datadog, Splunk, Sumo Logic, Elastic) automatically.

Retention

Audit logs are kept for as long as your workspace exists. When the workspace is deleted (30 days after you confirm the deletion, or 30 days after the end of an already paid period), the audit logs are deleted with it.

Plan availability

Available on the Enterprise plan, for administrators. On lower plans Deskwoot still writes the entries, but the Audit Logs page and its API are locked.

Typical compliance use cases

• SOC 2 access control evidence: show your auditor who was invited or removed and when someone signed in during the audit window.
• ISO 27001 A.12.4 logging: entries can't be edited or deleted in Deskwoot, which supports the standard's logging requirements.
• GDPR Article 28 processor recordkeeping: the audit log records what was done with personal data in your workspace, for example data subject requests.
• Incident response: "Did anything weird happen between 14:00 and 15:00 UTC?" Open the audit log, page to that time window, and look for unfamiliar users or unusual actions.

Frequently asked questions