Audit log — what is recorded, integrity, export

FedGrade writes workspace activity to an append-only audit log. This page describes exactly what it records today, what "append-only" means, and how to get the log out.

What is recorded today

Each row records an action and the thing it acted on. The actions recorded today are:

• Searches you run.
• Creates, edits and deletes of workspace records — for example cases and case evidence, notes, pWin assessments and bid decisions, proposals, contract records, webhooks, saved searches, watches, support tickets and inaccuracy reports.
• Exports — for example Brief PDF/DOCX exports, Brief decks, workspace data exports and audit-log exports.
• Shares and revocations — Brief share links created and revoked, embed widgets revoked.
• API-related actions — API key creation, rotation and revocation, and some API-key and system requests.

Coverage is not "every action". Sign-in events (successful or failed logins, MFA challenges, password resets), billing events (plan changes, payment-method updates) and member invitations are not recorded in the audit log today, and some create routes do not yet write a row. If your review depends on a specific event type, check the export for it rather than assuming it is there.

Every row carries these columns: id, workspace_id, user_id, action, entity_type, entity_id, ip, user_agent, request_id, payload_summary, metadata (JSON), result, and created_at. The ip, user_agent and request_id columns are only filled for rows written after that capture was added; older rows leave them empty, and the export tells you the date capture began.

Who can see it

The audit log is available to Government-tier workspaces through self-service export at /audit-log. On every other tier, /audit-log shows what the export contains and an upgrade prompt — there is no in-app audit-log viewer on Free, Pro, Team or Enterprise today.

Exporting (Government)

At /audit-log, pick a date range and optionally filter by action and entity type, then download CSV or JSONL. Each export is scoped to your workspace and capped at 100,000 rows; if more rows match, the download says it is incomplete and asks you to narrow the range. Every download reports how many rows it contains out of how many matched.

Retention

Audit-log rows are not deleted automatically today — no scheduled job removes them. Any retention period you need for a compliance programme is agreed in your contract. Streaming the log to a customer-owned storage bucket is on the roadmap and is not available today.

Integrity

What exists today: the log is append-only for workspace users — the write path is insert-only and no update or delete path is exposed to a workspace. That is the whole of the integrity property we currently provide.

What does not exist: there is no per-entry cryptographic hash chain. Nothing computes a rolling digest over prior rows, and exports carry no per-day hash manifest. A hash chain and verifiable export manifests are on the roadmap and will be documented here when they ship.

Do not describe FedGrade's audit log as cryptographically tamper-evident in a security questionnaire. "Append-only, database-enforced" is the accurate phrase.

See Data residency for where the data is stored and Data export for other exports.