When you need to know who changed a salary, who gave someone a new permission role or who signed in from an unfamiliar address, the audit log answers it in one place. It lists every sign-in and change across your account: who did it, when, where it came from, and from which device and IP address. You can filter it, search it and export it for a security review.
Who can use it
Only Super Admins can see the audit log.
Admins, managers and employees don't see it, whatever their permission role.
What the audit log records
Sign-ins and access: Logged in, Logged out, User password changed, User deactivated and Logged in on behalf.
Employees and fields: Employee invited, Employee created, Employee deleted, Field value changed, and fields being created, changed or deleted.
Permissions: permission roles being created, updated or deleted, and Role assigned when someone's permission role changes.
Time management: Balance adjusted, Policy assigned, Policy unassigned, Clocked in, Clocked out, Attendance edited and Attendance deleted.
Workflows: Workflow run deleted.
Open the audit log
Go to Account Settings → Audit log.
Each row shows:
Performed By: the person who did it.
Event: what happened, for example Field value changed.
Details: the change in words, for example who was affected and the old and new values. When one save changed several fields, click View details to see them all.
Date & time: when it happened.
Source: where the change came from: App, Import, Integration, Public API or Workflow.
User agent: Desktop or Mobile.
IP address: the address the request came from.
Click Refresh to load the newest events.
Find an event
Use Filter by at the top:
Date: Last 24 hours, Last 7 days, Last 30 days, Last 90 days, All time or a custom range.
Event: the type of event, grouped by area.
Source: for example only changes made by a Workflow or an Import.
User agent: Desktop or Mobile.
To find a person or an address, type in Search people or IP address.
To start again, click Clear filters.
Export the audit log
Set the filters you want. The export uses the same filters as the screen.
Click Export and choose CSV or Excel.
The file includes the date, performer, event, area, description, details, source, device and IP address of each event.
You can export up to one year at a time. With All time or a longer range selected, export is unavailable and shows Export is available for date ranges of up to 1 year. For a longer period, export it in parts.
Good to know:
The audit log only shows events from when Shapes started recording them. Older changes aren't in it. Some actions aren't recorded yet; the list above shows what's covered today.
A change made by a workflow, an import, an integration or the Public API shows that source, so you can tell automated changes from changes made by hand.
If the person who made a change was later deleted, Performed By shows Deleted employee.
Access can't be given to Admins through a permission role.
Use cases
A security review: filter Event to Logged in for the last 90 days and export it to Excel for the auditor.
An unexpected salary change: search for the employee, filter Event to Field value changed, and see who changed the salary, when, and whether it came from the app, an import or a workflow.
Checking access changes: before a quarterly access review, filter on permission events to see every role created, updated or assigned.
Audit log vs. Activity Log
The Activity Log shows the changes to one employee's profile. The audit log covers the whole account, including sign-ins, permission roles and time management.
Related articles: Activity Log, Permission Levels, Employee Change Report.