Security log

What the security log shows

Reports → Security log lists what happened to the accounts in your workspace, newest first: who signed in and from where, sign-ins that were refused and why, accounts that were blocked, unblocked or signed out everywhere, password changes and resets, invitations, and changes to a user's roles and groups. It complements the activity feed, which shows edits to your data; this log shows what happened to the people.

Hover the avatar of a row for the account's name. By is who did it: the account itself, an administrator, or the system. The device is worked out from the browser's own description; hover it for the full text.

A refused sign-in is recorded with its real cause, wrong password, no such account, email not confirmed, account locked or wrong workspace address, even though the sign-in screen itself only ever says the login was invalid or names the right address. A session ended because it was opened on another workspace's address is recorded with wrong workspace address too. When no account matched the name that was typed, the row shows the attempted name instead of an account, and only administrators can see those rows. A sign-in, accepted or refused, also says the credential it used, such as with a password.

A License applied row marks the moment a license was applied to the workspace, and by whom. It has no account, because it happened to the workspace and not to a person. A workspace created through sign-up starts its log with a Workspace created row, done by the system, on the account of the administrator it was created for. An AI companion set to … by the operator row says the platform's operator changed what the workspace may use of the AI companion.

Filters

Open Filters to narrow the log:

• Event type — sign-ins, failed sign-ins, sign-outs, passwords, account changes, access changes (roles and groups) or invitations. Pick several to combine them.
• Date range — events between two days (inclusive).

The log loads the newest entries first; use Load more at the bottom to keep going back. Entries older than 400 days are deleted automatically.

Your own account

Everyone can see their own history, no permission needed: open My profile from the account menu and pick the Security log tab. Use it to answer "was that sign-in me?": an address or a device you do not recognise means someone else has your password, and it is time to change it.

Administrators see the same history for any user on the Security tab of that user's profile, next to the block and sign-out actions, so "who blocked this account, and when" is answered in place.

Who can see it

The workspace-wide log needs the view security log permission. It shows every account's sign-ins and addresses, so it is a separate permission from the activity feed's, and it is not granted to any group by default; administrators always have it. Users without the permission do not see the menu entry, but still see their own account's history on their profile.