Audit Logs is the workflow at /settings/audit-logs. Audit logs record who changed what in ServiceFlow, supporting security reviews, dispute resolution, and compliance questions after the fact. A price dispute is a date plus a person, not a feeling. Pull the log for that afternoon and that user before you re-open the estimate and change it again.
Settings to Audit Logs (/settings/audit-logs) Admin-oriented; availability may depend on role. Filter by user, action type, date range (per UI filters). Inspect before/after details for supported entities. Investigate unexpected data changes or permission issues. Clock sync and timezone awareness for correlating with external systems. Set date range around the incident. Filter by user or entity type if available. Open entry to read action description and payload summary. Monthly export or spot-check admin actions. Cross-reference with Users & Roles changes. Document findings per your internal policy. Retention period may be finite, confirm with your hosting agreement. Not every field-level edit on every module is logged, coverage grows over time. No real-time alerting on suspicious activity built in. Export format may be UI-limited vs SIEM integration. Immutable log storage option for enterprise. If the before-and-after payload shows the total, you can tell the customer what moved. Clock skew between the office laptop and the server makes a 4:00 p.m.
Overview
Audit logs record who changed what in ServiceFlow—supporting security reviews, dispute resolution, and compliance questions after the fact.
How to access
Settings → Audit Logs (
/settings/audit-logs)Admin-oriented; availability may depend on role.
How do you browse chronological activity entries?
Browse chronological activity entries.
- Browse chronological activity entries.
- Filter by user, action type, date range (per UI filters).
- Inspect before/after details for supported entities.
- Investigate unexpected data changes or permission issues.
Prerequisites
- Admin or audit-view permission.
- Clock sync and timezone awareness for correlating with external systems.
Step-by-step
Investigate a change
- Settings → Audit Logs.
- Set date range around the incident.
- Filter by user or entity type if available.
- Open entry → read action description and payload summary.
Regular compliance review
- Monthly export or spot-check admin actions.
- Cross-reference with Users & Roles changes.
- Document findings per your internal policy.
Current limitations
- Retention period may be finite—confirm with your hosting agreement.
- Not every field-level edit on every module is logged—coverage grows over time.
- No real-time alerting on suspicious activity built in.
- Export format may be UI-limited vs SIEM integration.
Roadmap
- Webhook/stream to external SIEM.
- Alert rules (e.g. bulk delete, settings change).
- Immutable log storage option for enterprise.
Example: who changed the price after the customer complained
A price dispute is a date plus a person, not a feeling. Pull the log for that afternoon and that user before you re-open the estimate and change it again. If the before-and-after payload shows the total, you can tell the customer what moved. If the entity is one the log does not cover yet, say that plainly and use the estimate's own updated time instead of inventing a trail.
Monthly spot checks are for admin actions: invites, role changes, and integration toggles. They are not a substitute for invoice profit. Clock skew between the office laptop and the server makes a 4:00 p.m. entry look like 3:00 p.m. Compare in the business timezone.
An admin opens Settings → Audit Logs at /settings/audit-logs, sets the date range to the afternoon of the complaint, and filters by the office user. The entry shows the action and, for entities that are covered, a before and after summary. Use that to see whether the estimate total changed, not to reconstruct every keystroke.
Coverage is not every field on every screen. If the log is empty, that edit may not be recorded yet. There is no live alert when someone bulk-deletes. Export may be whatever the page offers, not a SIEM stream. Retention can be finite. Confirm how long rows are kept before you promise a two-year trail. Timezone matters when you line this up with a phone record from another system.
Webhook streaming, alert rules, and immutable storage are roadmap. A user without audit access does not get this menu. Deactivating a user later does not erase the entries already written under their name.