What is recorded

Every change made in your workspace is recorded with who made it, when, the address it came from and the browser they used:

Settings and records added, changed or removed, with what each field was before and after.
Actions such as publishing a flow, inviting someone, merging contacts or connecting an account, with what was entered.
Changes made through the agent API or an AI assistant connected over MCP, with the access token that made them.
People your identity provider adds or removes, and people who join through single sign-on.

Conversations are not repeated here. Messages, assignments, notes and tickets already keep their own history. Passwords, tokens and other secrets are never recorded, even when they were part of a change.

Messages themselves cannot be edited once they are saved, by anyone, so a conversation stays a faithful record of what was said.

Sign-ins

Each time someone signs in and opens your workspace, the log records it once for that sign-in, with how they signed in (a password, a password and two-factor authentication, single sign-on, or a remembered session), their address, their country and their browser. The inbox app is recorded the same way.

When the workspace turns someone away, for example because it requires two-factor authentication or single sign-on and they have not used it, that is recorded too, with the reason. Your log only shows sign-ins to your workspace, never where else someone went.

Reading and exporting

The audit log is part of the Business plan in UniversalChatbot. The owner and managers find it under Settings → Security → Audit log. You can search it, narrow it to a range of dates, switch between changes and sign-ins, open any entry for its details, and export what you are looking at as a spreadsheet.

Every workspace is recorded, whatever its plan, so on moving to Business you can read what happened before you upgraded, as far back as it has been kept.

How long it is kept

On Business, each entry is kept for three years.
On other plans, each entry is kept for six months.
Upgrading to Business keeps everything still held for three years from when it happened. Moving off Business never shortens what was recorded before.

Anything removed before you upgraded is gone and cannot be brought back.

Sending it to your systems

To keep a copy outside UniversalChatbot, such as in your security monitoring, the owner or a manager can send each entry to an address you control as it is recorded. Streaming is part of an Enterprise contract. Open Settings → Security → Audit log stream and enter:

Endpoint URL: an https address that accepts a POST for each entry. It has to be reachable from the internet.
Authorization header, optional: sent with every entry, for collectors that expect a token, such as Splunk <token>. Leave it blank to keep the one saved before.

Once saved, the page shows the signing secret and whether entries are being sent. Send test event sends a test entry so you can check your receiver. Clearing the endpoint URL stops sending.

Each entry arrives as JSON:

{
  "id": 42,
  "event": "audit.event_recorded",
  "created_at": "2026-10-16T09:30:00Z",
  "data": {
    "id": 9001,
    "created_at": "2026-10-16T09:30:00Z",
    "workspace": {"id": 18, "name": "Acme"},
    "actor": {"type": "user", "id": 7, "name": "[email protected]"},
    "action": "update",
    "subject": {"type": "support_team", "id": 3, "name": "Technical"},
    "details": {"name": ["Technical", "Tech support"]},
    "ip_address": "203.0.113.4",
    "user_agent": "Mozilla/5.0",
    "request_id": "c2f1..."
  }
}

actor is empty for something the system did, and names the identity provider for its own changes. details holds what changed, before and after, or what was entered.

Checking each event

Every entry is signed to the Standard Webhooks specification, so you can confirm it came from us with the official Standard Webhooks library for your language and the signing secret from the settings page. Each request carries webhook-id, webhook-timestamp and webhook-signature headers.

If your receiver does not answer with a success, the entry is tried again over about ten days, with longer gaps each time. A retried entry keeps its webhook-id, so you can ignore one you already have.

Rotate signing secret gives you a new secret. For 24 hours entries are signed with both the old and the new one, so you can update your receiver without missing any.

When sending stops

If your receiver fails 100 times in a row, or answers that the address is gone, we stop sending to it. The owner, and managers and admins who chose to get alerts about connections, are emailed with a link to the settings page, and the stop is recorded in the audit log.

Entries recorded while sending is stopped are not sent later, though they stay in the audit log for you to export. Once your receiver works again, choose Resume sending.

Deleting the workspace

When a workspace is deleted, its audit log and its stream settings are deleted with it. Export what you want to keep beforehand. See Deleting a workspace.

Audit log

On this page