Audit Log
Score CRM records every significant action taken by team members. The audit log gives you a complete timeline of who did what, when, and with which permission.
Why It Matters
- Incident response -- When something goes wrong, you can trace exactly who performed an action and when
- Compliance -- SOC 2, GDPR, and enterprise security reviews require audit trails
- Team accountability -- Managers get visibility into team activity as organizations grow
Accessing the Audit Log
- Go to Settings > Audit Log in the sidebar
- You need the audit_log:view permission to see the log
The audit log is available to all organizations -- not locked behind enterprise pricing.
What Gets Logged
Every create, update, delete, and send operation is recorded. This includes:
| Category | Actions Tracked |
|---|---|
| Campaigns | Created, updated, deleted, sent, paused, resumed |
| Lists | Created, deleted |
| Customers | Imported, exported, deleted |
| Segments | Created, updated, deleted |
| Journeys | Created, updated, deleted, activated, deactivated |
| SMTP Connections | Created, updated, deleted (credentials are never logged) |
| Suppressions | Created, deleted, imported |
| Custom Fields | Created, updated, deleted |
| Email Topics | Created, updated, deleted |
| Team | Invited, removed member, changed role |
| Roles | Created, updated, deleted |
| Auth | Login, logout |
What Is NOT Logged
- Read operations (viewing pages, loading data)
- Passwords, API keys, or credentials
- Bulk customer personal data
- Failed requests (only successful actions)
Filtering the Log
The audit log supports four filter dimensions that can be combined:
- User -- Filter by a specific team member
- Action -- Filter by action type (e.g., "Sent", "Deleted", "Changed role")
- Resource type -- Filter by what was acted on (e.g., Campaign, SMTP Connection, Role)
- Date range -- Quick presets (24h, 7d, 30d, 90d) or a custom date range
Click any entry to expand it and see full details including IP address, resource ID, and metadata.
Exporting the Audit Log
- Apply your desired filters
- Click Export CSV
- A CSV file downloads with all matching entries (up to 10,000)
The CSV includes: timestamp, user name, email, role, action, resource type, resource ID, resource name, metadata, and IP address.
You need the audit_log:export permission to export.
Each Log Entry Includes
Every entry captures a snapshot at the time of action:
- Who -- User name, email, and their role at the time
- What -- The action performed and the resource affected
- When -- Exact timestamp
- Context -- Additional details like recipient count, changed fields, or IP address
User names and roles are stored as they were at the time of the action. Even if a user changes their name or role later, the audit entry stays accurate.
Retention
Audit log entries are kept for 90 days and automatically cleaned up after that. If you need longer retention, export the log periodically.
Immutability
Audit log entries cannot be edited or deleted by any user, including the organization owner. This ensures the log is tamper-proof for compliance purposes.
Permissions
| Permission | What It Allows |
|---|---|
audit_log:view | View the audit log page and filter entries |
audit_log:export | Export audit log entries as CSV |
By default, the Owner and Admin roles have both permissions. You can assign these permissions to custom roles as needed.