> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> Who accessed what, when — the full PHI audit trail for your practice.

<Info>
  Every action that touches PHI in your practice is recorded. As a practice admin you can view, filter, and export the audit log — for routine oversight, incident investigation, or HIPAA audit response.
</Info>

## The audit log view

**Settings → Security → Audit logs**. Requires the `admin` role.

Each row shows:

| Column     | What it means                                                                      |
| ---------- | ---------------------------------------------------------------------------------- |
| Timestamp  | UTC, millisecond precision                                                         |
| Actor      | User ID, role at time of action, auth method                                       |
| Event type | `access`, `create`, `update`, `delete`, `export`, `disclosure`, `auth`, `settings` |
| Resource   | Model + ID (e.g. `OverturnableDenial#1234`) — not the PHI content                  |
| Action     | HTTP method + route or service call                                                |
| Result     | Success / failure / denied                                                         |
| IP + UA    | For troubleshooting and incident investigation                                     |
| Request ID | Correlates with application logs                                                   |

## Filters

* By actor (user, role)
* By event type
* By resource type
* By date range
* By result (show only failures / only denied)
* By IP

## What's captured

<AccordionGroup>
  <Accordion title="Every PHI read">
    Opening a denial, viewing a document, listing patients — all audit-logged.
  </Accordion>

  <Accordion title="Every PHI write">
    Creating, updating, or deleting a PHI-bearing record.
  </Accordion>

  <Accordion title="Every export">
    Data exports — CSV, XLSX, JSON, PDF. The exported content isn't logged, but the fact of the export and the scope are.
  </Accordion>

  <Accordion title="Every authentication event">
    Sign-in success, sign-in failure, 2FA enroll/use/reset, passkey register/delete, account lockout, session termination.
  </Accordion>

  <Accordion title="Every admin action">
    Role changes, user invites, user removals, settings changes, bulk operations, audit log access itself.
  </Accordion>

  <Accordion title="Every failed authorization">
    When Pundit denies an action, we log it — helps detect enumeration attempts.
  </Accordion>
</AccordionGroup>

## What's NOT captured

* The actual **content** of PHI being accessed — audit entries are metadata.
* API response bodies — to keep the audit log from becoming a second copy of your data.

This is intentional: we don't want the audit log to need the same level of protection as the source PHI.

## Retention

* **7 years** — exceeds the HIPAA minimum of 6 years.
* Stored in Cloud Logging with an independent immutable archive.
* Cleanup is automated for entries older than 7 years; before that, no admin (including Denialbase internal) can delete entries.

## Export

<Steps>
  <Step title="Settings → Security → Audit logs → Export">
    Filter to the date range or scope you need.
  </Step>

  <Step title="Choose format">
    CSV for spreadsheet analysis, JSON for programmatic review.
  </Step>

  <Step title="Download">
    Available within 10 minutes for typical ranges. Larger exports are emailed when ready.
  </Step>
</Steps>

<Warning>
  The export itself is an audit-logged event. Downloading 10,000 log rows will show up as a `settings.audit_log.export` entry in the audit log.
</Warning>

## Using the audit log for investigations

If you suspect improper access:

1. Filter by the suspect user and date range.
2. Look for patterns: off-hours access, unusually broad queries, bulk exports.
3. Export the filtered slice for formal review.
4. Suspend the account if warranted — see [Team management](/admins/team-management).
5. If you believe a breach may have occurred, notify [security@denialbase.com](mailto:security@denialbase.com) — we can help with the incident response.

## Integrating with your SIEM

* **Cloud Logging sink** — enterprise customers can have audit events streamed to their own GCP project via a Cloud Logging sink. Contact support.
* **Webhook** — per-event webhook (Q3 2026).

## Underlying architecture

*See [Audit logging](/trust/audit-logging) for the full architecture, integrity controls, and retention policy.*