# What is an audit log? Source: https://www.plutonapps.com/resources/what-is-an-audit-log Published 2026-09-30, updated 2026-10-24, sources checked 2026-10-24. By Irfan Habib (https://www.plutonapps.com/authors/irfan-habib). Reviewed by Irfan Habib, Co-founder (engineering) (https://www.plutonapps.com/authors/irfan-habib) ยท 2026-10-27. **Audit log:** An audit log is a permanent, append-only record of the significant actions taken in a system, showing who did what, to which record, when and from where, kept as evidence. Unlike application logs, it must not be editable by the people it records, and auditors rely on it. Also known as: Audit trail, Activity log. When something goes wrong, or an auditor asks, the audit log is how you answer "who did this?" with evidence. ## What goes wrong when an app has no audit log? A prototype rarely records anything beyond errors. Then a customer asks who deleted their project, a team member's access has to be investigated, or a security questionnaire asks how you trace administrative actions. Without an audit log, the honest answer is that nobody knows. ## Which actions belong in an audit log? An audit log should record the actions someone may later need to trace: sign-ins and failed sign-ins, changes to roles and permissions, anything staff do inside customer accounts, exports, deletions and billing changes, and actions taken by AI agents or integrations, attributed to the person who allowed them. - Sign-ins, failed sign-ins and changes to roles and permissions. - Anything staff do inside customer accounts. - Exports, deletions and changes to billing. - Actions taken by AI agents or integrations, attributed to the person who allowed them. > **What we see in practice** [Inkwave](https://www.plutonapps.com/work/inkwave) writes every operator action to an append-only audit log. [Bell](https://www.plutonapps.com/work/bell) records who authorized every send, reply and calendar invite, and its database refuses one no person approved. ## What should each audit log entry record? OWASP's Logging Cheat Sheet puts it as when, where, who and what: the date and time, the application, the source address, the user's identity, and the type of event. Just as important is what to leave out, such as passwords and access tokens. OWASP lists passwords, session identifiers (store a hash if you need to follow a session), access tokens, encryption keys and payment card data as things that must not be logged. ## How do you stop an audit log from being edited? NIST SP 800-53 has a control for exactly this, AU-9, Protection of Audit Information. OWASP's practical version: build in tamper detection so you know if a record was changed or deleted, restrict who can read logs and review that access, record all access to the logs themselves, and copy them to read-only storage as soon as you can. In a database, that usually means a table the app can insert into but never update or delete from. ## What audit logs does Supabase give a Lovable app? Supabase Auth records authentication events, including sign-ups, sign-ins, password changes and recovery, email verification, token refresh and sign-out. They are kept in Supabase's log storage, and can also be written to the auth.audit_log_entries table, where you can search them with SQL. Separately, platform audit logs record what your team members do in the dashboard, on Team and Enterprise plans only. Neither records what users do inside your app: who deleted a project, who exported a customer list. That log is yours to build, usually with [role-based access control](https://www.plutonapps.com/resources/what-is-role-based-access-control) deciding who can read it. The [production readiness check](https://www.plutonapps.com/tools/production-readiness-check) asks whether you have one, and an audit log is part of what an auditor looks for in [SOC 2](https://www.plutonapps.com/resources/what-is-soc-2). ## Frequently asked questions ### Should audit logs be immutable? Yes, in practice: append-only, with no way for the people being recorded to edit or delete entries, and kept for as long as your obligations require. Unlike application logs, which help engineers debug, it is evidence that security reviews and SOC 2 auditors rely on. ### What is the difference between an audit log and an audit trail? They are usually the same thing. Audit trail sometimes means the full chain of records around one transaction. Either way, it is an append-only record of who did what, to which record, when and from where, kept as evidence for reviews and investigations. ### What should never be written to an audit log? OWASP's Logging Cheat Sheet lists passwords, session identifiers, access tokens, encryption keys and payment card data among the things to exclude. If you need to follow one session's events, it suggests storing a hashed value of the session identifier instead of the identifier itself. ### Does Supabase keep an audit log for my app? Partly. Supabase Auth records authentication events such as sign-ins, sign-ups and password changes, optionally in the auth.audit_log_entries table. It does not record what users do inside your app, such as deleting or exporting records. That log you have to build yourself. ## Read next - [The Inkwave case study: every operator action in an append-only log](https://www.plutonapps.com/work/inkwave) - [The Bell case study: every send records who authorized it](https://www.plutonapps.com/work/bell) ## Sources - [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) - [NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations (September 2020), control AU-9, Protection of Audit Information](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf) - [NIST glossary: audit log](https://csrc.nist.gov/glossary/term/audit_log) - [Supabase documentation: Auth audit logs](https://supabase.com/docs/guides/auth/audit-logs) - [Supabase documentation: Platform audit logs](https://supabase.com/docs/guides/platform/audit-logs)