Audit log in Leadnote, who did what and when

The audit log is a read-only record of important changes in your Leadnote organisation: who did it, what they did, when, and from which network address. Use it to answer questions such as "who deactivated this user?" or "when did someone turn two-factor off?". Open Settings, then Audit Log.

Who can open it

By default the Account Owner and Managers can read the audit log. L1 Users and L2 Users cannot see it. Access follows the permissions for Settings, which the Account Owner can change. See roles and permissions overview.

Nobody can edit or delete entries.

What the table shows

Each row is one entry. The newest are first.

Rows with extra detail have an arrow at the left. Select it (Show details) to see the record's id and a small block of extra details, such as the old and new role. Select Hide details to close it.

The table shows 25 entries per page. Use Previous, Next and the "Page 2 of 8" counter to move through, and the line "Showing 1-25 of 190 entries" to see the total.

What gets recorded

The log covers changes made by people in the app, mostly administrative ones:

• Users and roles: invitations, role changes, deactivation and reactivation, ownership changes.
• Security: two-factor turned on, off or reset, recovery codes regenerated, trusted devices removed, sessions signed out, password changes, and changes to the two-factor requirement.
• Settings and structure: company settings, lead stages, fields, tags and similar catalogue settings.
• Billing and payments: plan and payment events, credits and gateway settings.
• Integrations and developer tools: API keys, webhooks and similar connections.
• Data: backups requested and downloaded, imports, exports, scheduled lead deletion, and organisation deletion requests.

Signing in and out is not shown here. To see sign-in attempts, use the Sign-in history card described in sessions and devices. The audit log is also not a record of every lead edit. For what happened to one lead, open the lead and read its timeline, see lead activity history.

Find an entry

Above the table you can narrow the list:

1. Type in Search action or summary... to match words in the action or in the summary.
2. Choose an Entity to see only one kind of record, for example only User entries.
3. Choose a User to see only one person's actions.
4. Set From and To dates. The "From" date must be on or before the "To" date.

The table updates as you change a filter. Select Reset filters to clear them all. If nothing matches, you see "No entries match these filters". Try a wider date range or clear the search.

A brand new organisation shows "Nothing has been logged yet" until someone changes something.

Export to CSV

Select Export CSV to download the entries that match your current filters as audit-log.csv. The file has the columns When (in UTC), User, Action, Entity, Entity id, Summary and IP. It contains the newest 5,000 matching entries. To go further back, set an earlier To date and export again.

The file opens in Excel, Numbers and Google Sheets. Keep exported files somewhere safe, because they contain names and network addresses.

Tips for using it

• Check it after a staff change, for example after you offboard someone, to confirm what was done. See also export your data.
• Filter by Entity "User" after a security email, to see whether anyone changed roles, passwords or two-factor.
• Filter by a User to review what one admin did over a period, such as before they leave.