Audit Trail

Overview

The SalesOS audit trail provides a comprehensive, immutable record of every significant action taken within your CRM environment. From individual field changes on a contact record to bulk data exports and administrative configuration updates, the audit system captures the full context of who did what, when, and from where.

Audit logging serves multiple organizational needs: security monitoring, regulatory compliance, dispute resolution, and operational troubleshooting. SalesOS logs events automatically with zero configuration required, ensuring that from the moment your organization starts using the platform, a complete history is being maintained.

What Gets Logged

SalesOS captures a broad spectrum of events across the platform. Every logged event includes the actor, timestamp, action type, and relevant contextual data.

Record Changes

All create, update, and delete operations on CRM records are captured with field-level granularity.

Login and Security Events

Data Exports

Every data export operation is logged regardless of method:

• Manual CSV/Excel exports from list views
• Report exports (PDF, CSV, scheduled)
• API bulk data retrieval exceeding configurable thresholds
• Integration sync pulls (when third-party systems extract data)
• Backup operations initiated by administrators

Permission and Configuration Changes

• Role assignments and modifications
• Permission set changes
• Field-level security updates
• Sharing rule modifications
• Workflow/automation rule changes
• Integration credential updates
• Feature flag toggles
• System configuration parameter changes

API Access

• Authentication token generation
• API calls exceeding rate limits
• Webhook delivery attempts and responses
• Third-party integration data access
• Bulk API operations

Bulk Operations

• Mass record updates (field values, ownership, status)
• Bulk imports (CSV, API-driven)
• Bulk deletes (with record count and filter criteria)
• Data migration operations
• Duplicate merge operations

Accessing Audit Logs

SalesOS provides multiple entry points for viewing audit information depending on your role and what you are investigating.

Admin Panel

The primary audit log interface is accessible at Dashboard > Admin > Audit for users with ADMIN role. This view provides:

• Full-text search across all audit events
• Advanced filtering (date range, user, action type, record type, IP address)
• Sortable columns with pagination
• Export functionality for compliance reporting
• Real-time streaming of new events

Per-Record History

Every CRM record includes a History tab showing all changes specific to that record:

1. Open any lead, contact, account, opportunity, or other entity.
2. Click the History or Activity tab.
3. View chronological list of all field changes, with old and new values displayed inline.
4. Filter by field name or date range.
5. See who made each change and whether it was manual, via automation, or via API.

User Activity View

Managers can view activity for specific team members:

1. Navigate to Admin > Users.
2. Select a user and click Activity Log.
3. View all actions taken by that user across the system.
4. Filter by action type or date range.

Audit Log Fields

Each audit event record contains the following structured data:

Filtering and Searching

The audit log interface supports sophisticated filtering to help you find specific events quickly.

Filter Dimensions

Search Syntax

The search bar supports structured queries:

user:jane.smith action:UPDATE entity:Opportunity
field:stage old_value:Qualification
ip:203.0.113.0/24 date:>2026-05-01

Saved Filters

Administrators can save commonly used filter combinations for quick access:

1. Configure your desired filters.
2. Click Save Filter and provide a name.
3. Optionally share the saved filter with other admins.
4. Access saved filters from the dropdown menu.

Record-Level Change History

Every entity in SalesOS maintains a complete field-level change history that is accessible directly from the record view.

Change Detail View

Each change entry shows:

• The field that was modified
• The previous value (with formatting appropriate to field type)
• The new value
• Who made the change
• When the change occurred
• Whether it was a manual edit, automation, API call, or import

Comparing Versions

For records with many changes, use the Compare feature to select any two points in time and see a side-by-side diff of all field values, highlighting what changed between those two snapshots.

Reverting Changes

Administrators can revert individual field changes:

1. Navigate to the record's History tab.
2. Find the change you want to undo.
3. Click the Revert icon next to the change.
4. Confirm the reversion (this creates a new audit entry documenting the revert).

Note: Reverting is itself an audited action. The system logs who initiated the revert, which change was undone, and the resulting values.

Login and Security Events

The security event log provides visibility into authentication patterns and potential threats.

Login Activity Dashboard

The security section of the audit trail includes:

• Login map: Geographic visualization of login locations
• Device inventory: All devices/browsers that have authenticated
• Failed login trends: Spike detection for brute-force attempts
• Session timeline: Active and historical sessions per user

Alerts and Anomalies

SalesOS can generate alerts for suspicious patterns:

Data Access Logs

Beyond record changes, SalesOS tracks who views sensitive data, even without making changes.

Read Access Tracking

For records marked as sensitive (e.g., containing PII, financial data, or classified deal terms), the system logs:

• Which user viewed the record
• When and for how long
• Which fields were visible based on their permissions
• Whether they exported or copied data from the view

Report Access

All report executions are logged, including:

• Report name and parameters
• Number of records returned
• Whether results were exported
• Scheduled report deliveries (recipients and format)

Retention Policies

SalesOS provides configurable retention periods for audit data to balance storage costs with compliance needs.

Default Retention

Retention Configuration

Navigate to Settings > Compliance > Audit Retention to adjust retention periods. Changes to retention policy are themselves logged and require ADMIN role.

Archival

When records exceed their retention period:

• Data is archived to cold storage (not immediately deleted).
• Archived data remains searchable but with higher retrieval latency.
• Permanent deletion occurs after a configurable grace period post-archival.
• Deletion events are logged in a separate, indefinitely-retained deletion log.

Exporting Audit Data

SalesOS supports multiple export formats and destinations for audit data.

Manual Export

1. Navigate to Admin > Audit.
2. Apply filters to scope the export.
3. Click Export and select format (CSV, JSON, PDF).
4. Choose whether to include full metadata or summary only.
5. Download begins (large exports are processed asynchronously with email notification).

Scheduled Exports

Configure recurring exports for compliance teams:

• Daily, weekly, or monthly cadence
• Configurable filters and format
• Delivery via email, SFTP, or cloud storage (S3, GCS, Azure Blob)
• Include summary statistics and anomaly flags

SIEM Integration

SalesOS integrates with Security Information and Event Management platforms:

Configure SIEM forwarding at Settings > Integrations > SIEM to stream audit events in real-time to your security operations center.

Compliance Use Cases

The audit trail supports requirements across multiple regulatory frameworks.

SOX (Sarbanes-Oxley)

• Tracks all changes to financial records (quotes, orders, invoices, revenue)
• Maintains separation of duties evidence (who approved vs. who created)
• Provides tamper-proof records for financial auditors
• Supports access control reviews with permission change history

GDPR (General Data Protection Regulation)

• Documents all processing activities on personal data
• Tracks consent changes and data subject requests
• Provides evidence for data access records (Article 30)
• Supports right of access requests with complete history
• Logs data deletion actions for right to erasure compliance

HIPAA

• Tracks access to protected health information (PHI) if stored in CRM
• Maintains minimum necessary access evidence
• Provides breach investigation data
• Supports required security incident documentation

SOC 2

• Demonstrates continuous monitoring of access controls
• Provides evidence of change management processes
• Supports logical access reviews
• Documents incident response actions

API Access to Audit Logs

Administrators can query audit logs programmatically via the SalesOS API.

Endpoints

GET /v1/audit-trail                    # List audit events (paginated)
GET /v1/audit-trail/:id                # Get specific event detail
GET /v1/audit-trail/stats              # Aggregate statistics
GET /v1/audit-trail/entity/:type/:id   # Events for specific record

Query Parameters

Rate Limits

Audit API endpoints have separate rate limits to prevent performance impact:

• 100 requests per minute for list queries
• 1000 requests per minute for single-event lookups
• Bulk export via API limited to 10 requests per hour

Best Practices

1. Establish a review cadence. Assign a team member (typically security or compliance) to review audit logs weekly for anomalies, even if you have automated alerting.

2. Configure SIEM integration early. Do not wait for an incident to set up external log forwarding. Real-time streaming to your SIEM ensures you have data when you need it most.

3. Use retention policies aligned to your industry. Financial services and healthcare typically require longer retention (7-10 years). Set policies during initial configuration to avoid gaps.

4. Leverage per-record history for dispute resolution. When reps disagree about deal ownership or field values, the record history provides an objective timeline that resolves conflicts quickly.

5. Monitor data export patterns. Unusual export volumes often precede data theft. Set alerts for exports that exceed normal baselines, especially from departing employees.

6. Document your audit review process. For compliance frameworks like SOC 2, you need to demonstrate not just that logs exist, but that someone actively reviews them with documented procedures.

7. Limit audit log access appropriately. While transparency is valuable, audit logs can contain sensitive information. Restrict access to ADMIN role and use the API for programmatic access by authorized systems only.

8. Test your audit trail periodically. Perform controlled changes and verify they appear correctly in the audit log. This validates that your logging is functioning and that no gaps exist.

9. Use saved filters for recurring investigations. Compliance officers and security teams often look for the same patterns. Save these as named filters to ensure consistency and save time.

10. Plan for audit data growth. Audit logs grow continuously and can become substantial for active organizations. Monitor storage usage and ensure your retention and archival policies balance compliance needs with cost management.