Audit log
Who changed what, and when? Learn to review the audit, notification delivery, AI invocation and translation logs on the Records screen.
The audit log shows who made each important change in the admin panel, when, and what changed. Use it to find out why a location was deactivated, who closed a ticket or who exported a report. It is the main source for internal audits, quality accreditation preparation and KVKK accountability.
Required role
The Records screen sits in the System menu group. The System area is managed by the Owner and Administrator roles.
The four modes of the Records screen
System → Records has four modes:
| Mode | What it shows |
|---|---|
| Audit | Actions in the admin panel, including exports |
| Notification deliveries | Every email, SMS, in-app and webhook delivery with its status (recipient masked) |
| AI invocations | Provider, model, latency, characters, tokens and status; prompts and content are not stored |
| Translations | Translations made by AI |
What the Audit mode records
Core actions: Create, Update, Delete, Restore, Escalate, Route, Close, Export.
Personnel actions: code issued, code renewed, welcome sent, welcome reminder, status changed.
Entries cover 30 entity types (locations, tickets, personnel, surveys, users and more). Each entry stores:
- the user who acted
- IP address and browser information (user agent)
- the data before and after the change
- a summary sentence in Turkish
User invitations, role changes and removing a user from the organization are audited too.
Investigate an action
Open Records
Go to System → Records and choose the Audit mode.
Narrow it down
Use the date range and other filters to find the action, for example locations deactivated last week.
Open the detail
Open the entry to see the before/after data, the user and the IP address.
Check the chain
The detail view reports whether the entry's chain link is valid.
Export if needed
You can export the log to Excel. That export is itself written to the audit log.
Tamper evidence: the hash chain
Each audit entry is linked to the one before it. Entries form an HMAC-SHA256 hash chain: every row carries its own hash and the previous row's hash. If a past entry is changed afterwards, the chain breaks and the detail view shows it.
Audit entries are not deleted
There is no automatic deletion or retention job for audit entries. Even a visitor data wipe or a factory reset keeps the audit tables.
Mind the personal data
Audit entries contain admins' IP addresses and browser information. Notification delivery recipients are masked, but the before/after data in an audit entry can carry the content of the changed record. Give access to the Records screen only to people who need it.
Tips
- For accreditation audits, use a ticket's own history together with the audit log, for example to show when a complaint was routed and to which team.
- To see when a user's role was changed, and by whom, search the audit log for user management actions.
Limits
- Audit entries cannot be edited or deleted by hand.
- Notification delivery logs show recipients masked.
- AI invocation logs do not show prompt or response content.
Related articles
Can't find what you need?
Our support team can help with anything from setup to reporting.
Bring your own AI keys
Connect your own OpenAI, Google Gemini or Anthropic Claude key instead of the ENA AI Gateway, and learn the fixed daily AI usage limits.
System settings
Get to know the 9 system settings areas, from organization identity, brand and regional settings to AI preferences, integrations and maintenance.