# Audit log (/docs/team/audit-log)

The audit log records who did what in your workspace, including denied attempts. Nobody can edit or remove entries. They are kept for 1 year, and when someone deletes their account, their name and email are removed from the entries they made. Open **Settings → Audit log**. Only owners and admins can view it.

## What is recorded [#what-is-recorded]

- Backups started by hand, cancelled or deleted.
- Restores and restore tests.
- Backup downloads, encrypted or decrypted.
- Databases added, changed, paused, resumed or removed.
- Destinations, encryption keys and notification channels added, changed or removed.
- Members, invitations and role changes.
- Workspace settings, billing changes and the spending cap.

Each entry shows the **Action**, **When**, the **Actor**, the **Target**, and with **Show details**, extra information such as the IP address and **User agent**.

## Find an entry [#find-an-entry]

- **Search the audit log** by person, file or database.
- Filter by category: **All activity**, **Backups**, **Restores**, **Databases**, **Destinations**, **Notifications**, **Members**, **Invitations**, **Workspace**, **Billing** or **Monitoring**.
- Filter by outcome: **Any outcome**, **Succeeded**, **Denied** or **Failed**.

## Activity [#activity]

For a lighter view that everyone in the workspace can see, **Activity** shows backup runs, restore tests and changes people made as they happen.

## Support access [#support-access]

When backupd support signs in as a member of your workspace to help you, the session lasts at most an hour and every action in it is recorded with the actor **backupd support as** the member.