Skip to main content

Audit Logs

Audit logs provide a complete record of all changes and activities in your Toggly account for compliance, security, and debugging.

What are Audit Logs?​

Audit logs record every action taken in Toggly, including:

  • Feature flag creation, updates, and deletions
  • Experiment starts, stops, and modifications
  • User access and permission changes
  • API key creation and revocation
  • Configuration changes
  • Environment modifications

Viewing Audit Logs​

  1. Navigate to Audit Logs in the Toggly dashboard
  2. Use filters to find specific events:
    • Date Range: Filter by time period
    • User: Filter by who made the change
    • Action Type: Filter by type of action
    • Resource: Filter by feature flag, experiment, etc.
  3. Click on any log entry to see detailed information

Audit Log Information​

Each audit log entry includes:

  • Timestamp: When the action occurred
  • User: Who performed the action
  • Action: What action was taken (create, update, delete)
  • Resource: What was changed (feature flag, experiment, etc.)
  • Before/After: Previous and new values (for updates)
  • IP Address: Source IP address of the action
  • User Agent: Browser or client information

Audit Log Retention​

Audit logs are retained according to your plan:

  • Free Plan: 30 days
  • Pro Plan: 90 days
  • Enterprise Plan: Custom retention (up to 7 years)

Exporting Audit Logs​

Export audit logs for compliance or analysis:

  1. Navigate to Audit Logs
  2. Apply filters if needed
  3. Click Export
  4. Choose format (CSV or JSON)
  5. Download the file

Compliance​

Audit logs help with compliance requirements:

  • SOC 2: Security and availability controls
  • GDPR: Data processing records
  • HIPAA: Healthcare data access logs (User given access to a feature granting them access to healthcare data)
  • PCI DSS: Payment card data access (User given access to a feature granting them access to payment card data)

Best Practices​

1. Regular Reviews​

Review audit logs regularly to:

  • Detect unauthorized access
  • Understand change patterns
  • Debug issues
  • Ensure compliance

2. Set Up Alerts​

Configure alerts for critical actions:

  • Feature flag deletions
  • Permission changes
  • API key revocations
  • Experiment modifications

3. Export Regularly​

Export audit logs periodically for long-term storage and compliance.

4. Monitor Access​

Watch for unusual access patterns or unauthorized changes.

Next Steps​