> ## Documentation Index
> Fetch the complete documentation index at: https://docs.florists.digital/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> A searchable record of sign-in activity and key changes, for compliance and incident review.

The **Audit Logs** record who signed in and who made key changes across your shop. They're the first place to look when something looks wrong and you need to know how it got that way.

<Info>
  **This page covers features gated by Admin-tier permissions** — typically Settings access. Admins have these by default; your administrator can adjust who has them in [Settings > Team](/settings/team).
</Info>

## What's logged

Each entry captures the event type, the user (or driver), the time, and a short message. Many entries also record the before and after values where a record was updated.

The audit log covers actions such as:

* **Sign-in activity** — successful logins, failed attempts, and blocked attempts.
* **Support sessions** — when Digital Florists support signs in or out of your shop.
* **Customers** — created, updated, merged, or deleted.
* **Customer addresses and contacts** — created, updated, or removed.
* **Orders** — cancellations, reopens, label prints, location changes, attachments.
* **Transactions** — voids and unvoids.
* **Team** — new team members and profile updates.
* **Settings** — changes to payment methods, locations, tax rates, delivery slots, occasions, banners, promotions, categories, and similar reference data.
* **Data exports** — when financial or end-of-day reports are exported.

Not every action in the product writes to the audit log. If a specific change isn't appearing, [get in touch with support](/get-started/getting-help) and they can confirm whether that surface is covered.

## Searching and filtering

The table sits on the **Settings > Audit Logs** page, with the most recent entries at the top. You can:

* **Search** by event type, message text, username, driver name, IP address, or actor identifier.
* **Filter** by user, driver, event type (auth success, auth failed, auth blocked, data export), or outcome.
* **Sort** by ID or creation date.

For free-text search across an order's history, the order itself usually has more readable context than the audit log — check there first.

## Retention

Entries aren't deleted on a schedule and the page is read-only — there's no edit or delete control in the dashboard. If you need to share a slice with an external auditor, [get in touch with support](/get-started/getting-help) and they can help pull the records you need.

## Common questions

<AccordionGroup>
  <Accordion title="Can I see who looked at an order without changing it?">
    Read events aren't logged. The audit log focuses on changes and sign-in activity, so the table stays readable.
  </Accordion>

  <Accordion title="Why can't I find a specific change in the log?">
    Coverage varies by surface — some areas write detailed entries, others don't write any. If you can't find what you expected, [get in touch with support](/get-started/getting-help) with the order or record details and they can check.
  </Accordion>

  <Accordion title="What if a logged action looks suspicious?">
    [Get in touch with support](/get-started/getting-help) with the entry ID and a short description. They can pull the full context, including the request path, IP address, and the raw before/after values.
  </Accordion>
</AccordionGroup>

## What's next?

<Columns cols={2}>
  <Card title="Team" icon="users" href="/settings/team">
    Manage roles and permissions.
  </Card>

  <Card title="Disaster recovery" icon="rotate-left" href="/settings/disaster-recovery">
    Restore data from an earlier point in time.
  </Card>
</Columns>