Audit log
Every important action on a doc and across an org is recorded with actor, event type, and timestamp. Used for the History panel, the org audit page, and compliance review.
Sweetdocs writes an audit event for every meaningful action on a document — saves, shares, public-link toggles, restores, comments, edits by collaborators. Org-level events extend the same schema (member changes, library creates, domain captures).
These events power three distinct UI surfaces:
| Surface | Scope | Audience |
|---|---|---|
| Doc History panel | One document | Anyone with read access to the doc |
| Org audit page | Whole organization | Org Owners + Admins |
| Search / dashboards (internal) | Compliance and security | sweetdocs operators when investigating issues |
| Actor | Action | Resource | Time |
|---|---|---|---|
| L Lee Vaniderstine | Saved a version | kyoto-trip | 2m ago |
| S Sam Park | Shared access | Architecture | 14m ago |
| L Lee Vaniderstine | Made public | Pricing notes | 1h ago |
| A Avery Chen | Restored a version | Auth migration plan | 3h ago |
| @ marisol@vendor.com | Domain capture | Org | yesterday |
Event types
Every event has a event_type, a payload (JSON with event-specific fields), and a created_at. The current types:
| Event type | Doc-scoped label | Org-scoped label |
|---|---|---|
version | Version saved | Saved a version |
view | Viewed | Viewed |
share | Shared <level> with someone / a group | Shared access |
unshare | Revoked <level> access | Revoked access |
public_on | Made public (share link enabled) | Made public |
public_off | Made private (share link disabled) | Made private |
restore / version_restored | Restored a previous version | Restored a version |
comment_received | New comment | Commented |
comment_replied | Replied to a comment | Replied |
mentioned | Mentioned a collaborator | Mentioned someone |
doc_edited_by_collaborator | Edited by a collaborator | Edited |
The labels are deliberately written two ways: the doc-scoped version reads like “what happened to this doc,” the org-scoped version reads like “what this person did.”
Doc-level audit (the History panel)
The History panel (right-side, clock icon in the toolbar) shows the audit timeline for the current document. Each row is one event.
Versions are clickable to preview / restore; non-version events are read-only timeline markers.
This is per-doc, per-user. Anyone with read access sees the same timeline.
Org-level audit
For orgs, an aggregate view of every event across every doc, folder, library, and member is available on the org page. This is Owner + Admin only — Members don’t see other people’s actions.
What’s covered org-wide:
- All the doc-scoped events above (across every doc in the org’s libraries)
- Membership changes (added, role updated, removed, ownership transferred)
- Group changes (created, members added / removed, deleted)
- Library changes (created, renamed, sharing-mode changed, deleted)
- Domain captures (every auto-join via domain capture)
- Sign-in events (recorded with timestamp, IP, user agent)
- Sign-out events (including sign-out-everywhere)
What’s recorded with each event
Every event row includes:
| Field | Value |
|---|---|
actor | Who did it (user ID + display name + avatar) |
event_type | The action type (from the table above) |
payload | Event-specific metadata as JSON |
created_at | When it happened (UTC, displayed in viewer’s local time) |
resource | The doc / folder / library / org targeted (for actions on resources) |
For sign-in events, IP address and user-agent string are also captured for security review.
Retention
Audit events are retained according to your plan’s data retention policy:
- Free / Pro: Personal audit only (your own History panel). No long-term org audit because there’s no org. Local audit is kept as long as the resource exists.
- Teams: Full org audit retained for the duration of the subscription, plus standard data retention after cancellation.
Export to CSV
Org Owners and Admins can export the audit log as CSV from the org audit page. Useful for:
- Compliance reviews (SOC 2, ISO, GDPR)
- Internal investigations (who modified this doc when)
- Reporting to insurance providers after a security event
The CSV includes every column shown in the UI plus the full payload JSON for each event.
What the audit log isn’t
| Not | Why |
|---|---|
| A way to see “all access to a document” by readers (public link viewers) | Public link views are recorded as anonymous view events with no actor |
| Real-time alerts | The log is post-hoc — set up notifications separately if you need them |
| Tamper-proof / blockchain-style | The DB is the source of truth; we don’t write to an append-only log outside Postgres |
| Free / Pro org audit | Free/Pro doesn’t have orgs |
| Real session activity (every API call, every keystroke) | Only meaningful semantic events are recorded — not every individual HTTP request |
Compliance posture
For SOC 2 / ISO 27001-style audits, the org audit log is the primary artifact. It captures:
- Identity (who took the action)
- Action (what type of event)
- Object (which resource was affected)
- Time (when it happened)
- IP/UA for sign-in events
This is the standard four-W audit shape and meets most “log every administrative action” requirements.