Audit Log

The audit log is a tamper-evident record of who changed what and when — every change and sensitive read, with field-level before/after detail. Use it for compliance, investigations, and client transparency.

Key capabilities

• Automatic logging of every change (create, update, delete) plus sensitive reads (financials, personal data, admin pages)
• Actor attribution: user, email, advisory firm, session, and sign-in method
• Field-level before/after change tracking on updates
• Readable summaries (e.g. "created Invoice #INV-001 for Acme Corp"), grouped by day with repeated identical events collapsed
• Action, Type, User, and Outcome filters, full-text search, a date range, and quick 24h / 7d / 30d / 90d presets
• Today's counts (events, successes, failures, errors, active users) — click Failures or Errors to filter
• View full history for any record ("who touched this invoice?")
• Verify button showing how much of the log is sealed against tampering
• AI Analyze for unusual patterns and segregation-of-duties concerns
• Export… to CSV, Excel, or JSON with the columns and date range you choose
• Long-term archive in write-once storage, plus alerts for unusual locations, mass deletions, failed sign-in spikes, VPN/Tor use, and permission changes

How it works

DayZero captures every qualifying action, adds details about the record involved, and links each entry to the one before it so edits or deletions are detectable.

flowchart TD
  req["Change or sensitive read"] --> capture["Audit capture"]
  capture --> enrich["Add actor, record, before/after"]
  enrich --> chain["Seal in tamper-evident sequence"]
  chain --> store["Audit log"]
  store --> feed["Activity feed / history / AI analysis / export"]

How to use it

1. Open Settings → Audit Log to see recent activity (the last 30 days by default). If you manage several businesses, pick one first.
2. Narrow with the Action, Type, User, and Outcome filters, the date range or presets, or search (press Enter).
3. Expand any entry to see exactly what changed and its outcome and any error.
4. Click View full history on an entry to see everyone who touched that record.
5. Click Verify to check the tamper-evidence status, or AI Analyze to surface unusual patterns.
6. Click Export… to download the filtered log (for example, filter to one user for a data-subject request). Choose CSV, Excel, or JSON, a range (All time, 7, 30, or 90 days, or Custom), and which columns to include. An export holds up to 10,000 rows by default.

Pro tips

• Investigate discrepancies fast by combining a tight date range with a Type and Outcome = Failure to isolate what went wrong.
• After teammates make bulk changes, scan the log to confirm everything applied — and that nothing failed silently.
• Use View full history before reversing an entry so you understand who created and edited it.
• Treat a Partially sealed result in Verify as something to raise with support, not a glitch.
• Watch for mass deletions, failed sign-in spikes, and VPN/Tor use as early warning of account compromise.

In-depth guide

What gets logged

Every change is logged automatically, along with sensitive reads (financial data, personal data, admin pages). Actions are named for what actually happened: searches, previews, and validations are recorded as reads, never as "create", and report runs are logged as generated reports with the report's title.

To keep the trail useful, background status and progress checks and calculations that save nothing are not logged. Actions taken by DayZero support staff who added themselves to your business are hidden from your own users.

Outcomes

The Outcome filter offers Success, Failure, and Error. Entries can also be marked partial (mixed batch results), denied (permission refused), skipped (nothing to do), or suspicious.

Data classification & retention

Each record type is classified by sensitivity, which drives compliance filtering and retention.

Tamper detection

Each entry is sealed to the one before it in sequence. Verify reports Fully sealed when every entry is sealed, with the sealed count, sequence range, and time span. Any silent edit or deletion would break the chain.

Anomaly alerts

DayZero watches the log and raises alerts, from informational up to critical, for unusual access locations, bulk operations and mass deletion, failed sign-in spikes, VPN/Tor use, permission escalation, and sensitive-data access.