Skip to main content

Audit & Compliance

Comprehensive audit logs and compliance features for enterprise customers.

Audit Logs​

Complete audit trail of all activities:

  • Feature Flag Changes: All create, update, delete operations
  • Experiment Changes: Experiment lifecycle events
  • User Access: Login and access attempts
  • Permission Changes: Role and permission modifications
  • API Usage: All API requests and responses

Compliance Certifications​

Toggly maintains:

  • SOC 2 Type II: Security, availability, and confidentiality
  • GDPR: European data protection compliance
  • CCPA: California consumer privacy compliance
  • ISO 27001: Information security management (Enterprise)

Audit Log Integrity​

Audit events are protected with HMAC-SHA256 integrity hashes stored alongside each record. On read, Toggly recomputes the hash and exposes the result as integrityValidated in the API and in the Audit Event Details modal.

  • Verified — the event matches its stored hash.
  • Failed — the hash does not match; investigate potential tampering.
  • Not verified — applies only to synthetic deployment entries (Environment:DeploymentDetected) that are derived from deployment history rather than stored audit documents.

Data Retention​

Configurable data retention:

  • Audit Logs: 30 days to 7 years (based on plan)
  • Metrics Data: Configurable retention periods
  • User Data: Deleted upon account closure
  • Feature Flag History: Retained per plan

Export & Reporting​

Export audit logs for compliance:

  • CSV Export: Spreadsheet format
  • JSON Export: Machine-readable format
  • Scheduled Reports: Automated compliance reports
  • Custom Reports: Create custom audit reports

Best Practices​

  1. Regular Reviews: Review audit logs regularly
  2. Export Regularly: Export logs for long-term storage
  3. Monitor Access: Watch for unauthorized access
  4. Document Procedures: Document compliance procedures

Next Steps​