Security
Audit logs
Read the immutable record of who did what in your workspace, and how to export it for compliance.
Every state-changing action in your workspace writes an audit event: invitations, role changes, environment requests, integration connects, billing changes, and cross-tenant grants. Audit logs are append-only — entries cannot be edited or deleted from the portal, by any role.
What each entry records
- Actor — the member (or the private admin service) that performed the action.
- Action — a stable machine key such as
invitation.resentorcontrol_plane.feature-opt-in.update. - Entity — the type and identifier of the object that changed.
- Timestamp — when the action was recorded, in UTC.
Reading the log
Open Audit logs from the workspace overview. Entries are newest-first. Use the actor and action filters to narrow an investigation — for example, "every role change in the last 30 days."
Exporting for compliance
Owners can export the current filtered view. Exports are generated server-side and scoped to your tenant only. If an export is empty, widen the date range — a fresh workspace has few events.
Related
Related documentation
- Tenant isolationHow OSTaaS keeps every workspace's data, environments, and evidence separated from every other tenant.
- Roles & accessThe four workspace roles and what each one can do.
- Authentication & securityHow sign-in works under the hood, including sessions, providers, and the deterministic result screen.