The audit log
An append-only record of every security-relevant act in a workspace, and a separate log of what changed on its account.
Who can read it: admins and the Owners of the account that holds the workspace, on the Enterprise plan. Members whose custom role includes Read the audit log can read it too.
The workspace audit log is "Every security-relevant act in this workspace: who let someone in, who granted power, who minted a credential. Append-only: entries are never edited or removed." Entries are kept for as long as the workspace exists, and are removed with it when a workspace is deleted.
transglot records these events on every plan. Reading and exporting the log is an Enterprise feature, so if you move to Enterprise, earlier entries are already there.
Read the log
Open the audit log
Open Settings, choose the Workspace tab, then Audit log.
Filter by action
Under Events, entries are listed newest first, each with the act, who did it (or "by the system"), its Category and When. Use Filter by action to show one kind of event, or All actions for everything.
Export to CSV
Select Export CSV to download the log, or the filtered part of it, as a spreadsheet. The export holds every matching entry, with the time, action, the person's name and email address, what the act was about, the IP address and the details recorded with it.
What is recorded
| Area | Examples of recorded acts |
|---|---|
| People and access | Member invited, joined, role changed or removed; invitations revoked or sent again; custom roles created, updated or deleted; review policy changed; two-factor requirement changed |
| Credentials | API tokens, publishable keys and CDN keys created or revoked; translations exported; export links ended |
| Integrations | Webhook endpoints; the Slack channel; Jira, GitHub, GitLab, Bitbucket and Azure Repos; CMS, Dropbox, Google Drive and S3 connections; integration add-ons; migration imports |
| Identity | SSO configured, tested or disabled; SSO sign-ins; SCIM token rotated or SCIM disabled; users provisioned or deprovisioned through SCIM; directory group mappings |
| Assignments | Translators assigned; assignments started, submitted, approved, sent back or withdrawn |
| Workspace and projects | Workspace renamed, moved to another account, deletion requested or cancelled; project web address changed; languages removed; projects deleted; branding updated |
The audit log is the security record. A project's activity feed is the product history of keys, translations and runs. Use activity to find out when a string changed, and the audit log to find out who was given the ability to change it. See Project activity.
The account log
Changes to the account itself (its plan, card, invoices, seats, people and workspaces) are recorded in a separate Account log. Open Settings, choose the Account tab, then Account log. Use Filter by category to narrow it.
- Account Owners and Billing members can read the account log, on every plan.
- Billing members see the billing entries only, without the IP address column.
- Only account Owners can select Export CSV.
If it doesn't work
- "Audit log is an Enterprise feature": "We record every security-relevant act regardless of plan. Reading and exporting the trail is an Enterprise feature." The panel has a Contact sales button, because Enterprise is arranged with sales rather than bought at checkout.
- "Nothing to audit yet": nothing auditable has happened in this workspace yet.
- "No entries for that action.": the filter matches nothing. Choose All actions.
- Audit log is not in the Workspace settings menu: your role does not include reading the audit log.