Audit Log
A tamper-evident record of every security-relevant action on your project.
Grovs keeps a per-project audit log: an append-only record of who did what, when, and from where. Every entry is chained to the one before it with a SHA-256 hash, so a missing or altered entry can be detected.
Admins read it in the dashboard under Audit Logs. To pull it into Splunk, Datadog, or any other SIEM, see the SIEM integration guide.
Availability
The audit log is available on:
- Self-hosted deployments — always on, no configuration needed.
- SaaS projects on an enterprise plan.
Other projects don't record audit events, and the audit endpoints answer 403.
Only admins of a project can read its audit log or manage its export tokens. Members don't see the Audit Logs page at all.
What gets recorded
One entry per business action, no matter how many rows it touched.
| Family | Examples |
|---|---|
| Auth | user.login, user.login_failed, user.sso_login, user.password_changed, user.2fa_enabled |
| Membership | instance.member_added, instance.member_removed |
| Project | instance.renamed, instance.retention_changed, instance.deletion_requested, instance.deleted |
| Credentials | audit_export_token.created, audit_export_token.revoked, mcp_token.revoked, api_key.used, api_key.auth_failed |
| Configuration | ios_configuration.updated, android_configuration.updated, web_configuration.updated, redirect.updated, domain.updated |
| Custom domains | custom_domain.created, custom_domain.verified, custom_domain.deleted |
| Data | link.created, link.updated, link.deleted, export.link_data, export.usage_data |
| Billing | enterprise_subscription.created, subscription.changed |
| System | retention.deletion_ran, quota.disabled, quota.restored |
Each entry carries the actor (user, api_key, admin_key, or system), the credential channel it came through (dashboard, sso:google, mcp_token, api_key…), the target, a before/after diff where one applies, plus IP, user agent, and request ID.
The audit log is project-wide, not per-environment. Production and Test share one chain, because most of what it records — membership, billing, retention — isn't environment-specific.
What you can rely on
- Completeness — the entry is written in the same database transaction as the action itself. An audited action cannot succeed without its record.
- Append-only — entries are never updated or deleted, not even when the project is deleted.
- Ordering —
sequenceis a gap-free per-project counter, and the only cursor you need. - Integrity — every entry stores the previous entry's hash, forming a chain you can verify independently.
Secrets are filtered
Credentials never reach the log. Values such as API keys, push certificates, and client secrets are replaced with [FILTERED] in the changes diff, so an entry records that a secret changed without recording the secret.
Reading it in the dashboard
Open Audit Logs from the sidebar. You can filter by action, by actor email, and by date range, and click any row to open the full entry — including the before/after diff and the hash-chain position.