Sovos Docs

About the audit trail

Learn about the audit trail and what activities are tracked through audit logs.

The audit trail provides clients with visibility into user activities and system events within Compliance Network. This feature enables clients to:

  • Meet compliance and governance requirements by tracking all user actions and configuration changes.

  • Monitor user behavior and identify potential security incidents.

  • Support internal and external audits with comprehensive activity logs.

  • Investigate incidents by reviewing historical user actions and system events.

  • Maintain accountability through detailed tracking of who performed what actions and when.

Activities tracked in Audit Logs

The audit trail captures the following types of activities in the Audit Logs:

User login
Records when users successfully authenticate to the system, including timestamps and IP addresses.
User logout
Tracks when users end their sessions.
Portal access
Logs when users access different areas of the Compliance Network UI.
Last access dates
Maintains records of the most recent user activity.
Document submissions
Records when documents are submitted through the platform, including submission metadata.
Document submission history
Maintains a complete history of document-related transactions.
Document status changes
Tracks changes to document processing status.
Workspace-level configuration changes
Records changes to workspace settings and parameters.
Organization-level configuration changes
Tracks changes to organizational settings.
System configuration changes
Logs administrative configuration changes.
User ID and timestamp for each change
Identifies who made changes and exactly when they occurred.
Note:

Audit trail data is stored for up to 13 months.

User role and access permissions

The following user roles have access to the audit trail and audit logs:
Workspace Users
Can access all configuration changes and activities related to their specific workspace. Workspace users audit activities within a single business or department.
Organization Users
Can access all configuration changes and activities across all workspaces within their organization. Organization users oversee audit trail data for the entire organization.
System Administrators
Can access all configuration changes across all workspaces and organizations. System admins use platform-wide monitoring and system-level compliance verification.
Tracking user login activity.
Scenario:
A compliance officer needs to verify that only authorized personnel accessed the system during a security audit period.
Audit trail entry:
  • Event type: User login

  • User ID: john.smith@company.com

  • Timestamp: 2025-09-28 14:32:15 UTC

  • IP address: 192.168.1.45

  • Action: Successful authentication

  • Workspace: Finance-NA

Use case:
The compliance officer can generate a report that shows all login events during the audit period, verify that no unauthorized access occurred, and confirm that access patterns align with expected business hours.
Document submission audit.
Scenario:
A client disputes when they submitted an invoice, and the team needs to verify the exact submission date and time.
Audit trail entry:
  • Event Type: Document submission

  • User ID: supplier.integration@vendor.com

  • Timestamp: 2025-09-25 16:47:33 UTC

  • IP Address: 203.0.113.78

  • Action: Invoice submitted via API

  • Document ID: INV-2025-09-5847

  • Document Type: Commercial Invoice

  • Status: Accepted for processing

  • Workspace: Procurement-APAC

Use case:
Customer support can provide the exact timestamp and confirmation from the audit log that the invoice was successfully submitted.