Activity & audit log

Your activity log is a personal, tamper-evident record of what happened in your account: sign-ins, vault and item changes, sharing, and security events. Use it to answer "was that me?" after an unexpected email, or to double-check what a device did.

What gets recorded#

Events are grouped into streams:

• Authentication — sign-ins (successful and failed), sign-outs, password changes.
• Data changes — vault and item create/update/delete.
• Sharing — invitations, share links, permission changes.
• Data access — items opened and secrets revealed (logged on Team plans and above).

Each entry records the action, your device and IP address, the affected resource, a severity level, the result (success or failure), and the time. Failed attempts are logged too — they're often the most interesting entries.

Review your activity#

1. Open Activity Log in the My security sidebar (My security on some plans). The page is titled My Activity Logs.
2. Pick a tab, then a quick range — Last 7 days, Last 30 days, Last 3 months — or set custom From and To dates (up to 3 months per query).
3. Narrow the list with the filters below, or search by action.
4. Use Download to export the current view as CSV.

Tabs#

Tab	What is in it
All activity	Every event recorded on your account
App & Account Management	What you and platform admins did inside the application — account changes, vaults and items, sharing, roles and policies, DevOps secrets and configuration
Connection & Security	How you connected — sign in / out, two-factor and identity, sessions, devices
Billing & Payments	Checkout and billing details, payments and refunds, subscription changes
Security	Threat protection, backup codes and breach monitoring, mobile and verification, policy denials

Each tab shows a count. A tab your plan cannot see is hidden rather than shown empty, so you may see fewer tabs than this table lists.

Filters and columns#

• Actions — a multi-select grouped by the sub-headings above (for example Vaults & items or Sign in / out). The badge on the button counts what you have ticked.
• Severity and Result — each defaults to All severities / All results.
• Clear N filters — appears once any filter is active and resets them.
• A line under the filters tells you which time zone the times are shown in.

The table has the columns Action, Performed by, Device & IP, Resource, Severity, Status and Time. With nothing to show you see No Activity Found.

On a Free plan a Limited Audit Log banner explains that the free plan only highlights generic events, with an Upgrade button.

Your connected devices and sessions are not on this page — they are under Account; see Active sessions and Devices.

Tamper evidence#

Every entry is cryptographically chained to the one before it: each record includes a hash of its own contents plus the previous entry's hash, and is signed by the server. Altering, inserting, or deleting a past entry breaks the chain and is immediately detectable — your history is effectively append-only. Organization admins on Business/Enterprise plans can run chain verification; see Audit log architecture.

Retention and plan differences#

How long entries are kept depends on your plan, and so does which tabs you can see:

Plan	Retention
Free	30 days
Premium	90 days
Solo Professional	90 days
Family	1 year
Team	1 year
Business	7 years
Enterprise	Unlimited

Older entries are purged automatically when their retention period ends.

For organizations#

This page shows your own activity only. Team and business admins get organization-wide logs, dashboards, and compliance exports in Organization audit logs and the Reports Center.