Audit Log

Every database connection through DAAM is logged with the developer's identity and session metadata. The audit log provides a tamper-resistant record for compliance and security review, covering both database connections and administrative activity across your organization.

Overview

The audit log captures two categories of events scoped to your organization:

• Connections — every database session proxied through a DAAM agent, including who connected, which database, duration, query count, and the policy version enforced.
• Activity — administrative actions such as membership changes, invite management, SCIM provisioning events, and organization-level operations.

Both categories are accessible from the Audit page in the console, organized into two tabs. All data is scoped to the current organization and cannot be viewed across organizations.

The audit log below shows a live preview of the connections table with sample data. Use the filter dropdowns and time range picker to explore the interface.

What's Logged: Connections

Every database connection proxied through a DAAM agent generates an audit record with the following fields:

The agent reports connection lifecycle events to the control plane automatically. No additional configuration is required to enable audit logging.

What's Logged: Activity

Organization-level administrative actions are recorded as activity events. Each event captures the action type, the actor who performed it, and contextual metadata.

Each activity event records the actor (the user who performed the action, or "System" for automated operations), the target (the affected user, invite, or group), and additional metadata specific to the event type.

Viewing the Audit Log

Navigate to Audit in the console sidebar. The audit page has two tabs:

Connections Tab

The default tab shows all database connections for your organization. The table displays user, database, connected at, duration, queries, close reason, and status columns.

Use the filters at the top of the table to narrow results:

• User — filter by a specific organization member.
• Database — filter by a specific database registered in your organization.
• Time window — select a preset range (1 hour, 24 hours, 7 days, 30 days, 90 days) or specify a custom date range.

The default time window is the last 24 hours. Results are paginated for large result sets.

Activity Tab

Click the Activity tab to view administrative events. The table displays event type, actor, target, details, and time columns.

Activity events can be filtered by:

• Event category — filter by Members, Invites, Organization, or SCIM events.
• Actor — filter by the user who performed the action.
• Time window — same preset and custom range options as the Connections tab.

Time Window Picker

Both tabs share a time window picker for scoping results to a specific period. Click the time range button to open the picker.

Connection Details

Click the View button on any connection row to open a detail panel on the right side of the screen. The panel displays:

• Full connection metadata — user, database, agent, connected at, disconnected at, duration, close reason, and query count.
• Policy version — the exact policy version that was enforced during this connection.
• Session event timeline — a chronological list of events that occurred during the session.
• Access requests — links to any access requests that contributed to granting this connection.
• Raw JSON — the complete connection record in JSON format, collapsed by default. Useful for copying into external tools or support tickets.

Each connection is also accessible at a direct URL for bookmarking or sharing with other administrators in your organization.

Activity Details

Click the View button on any activity row to open a detail panel showing:

• Event type — the specific action that occurred, with a human-readable label.
• Actor — email of the user who performed the action, or "System" for automated operations.
• Target — the affected user, group, or resource, resolved contextually based on event type.
• Full metadata — all event-specific details such as role changes, email changes, or SCIM external IDs.
• Raw JSON — the complete event metadata in JSON format for inspection.

Retention

Audit records are automatically cleaned up based on your billing plan and server-side retention configuration. A background job runs hourly to remove records that exceed the retention window.

Both connection records and activity events are subject to the retention period defined by your plan.

Compliance

The audit log is designed with compliance requirements in mind:

• Append-only — audit records cannot be modified or deleted through the application. Only the automated retention cleanup removes expired records.
• Identity-linked — every connection and activity event is tied to a specific user identity, providing a clear chain of accountability.
• Policy-versioned — connection records capture the exact policy version enforced, so you can reconstruct what access controls were active during any session.
• Organization-scoped — audit data is strictly isolated to each organization. Members of one organization cannot view another organization's audit records.
• Configurable retention — retention periods align with your compliance requirements, from 7-day windows for development to unlimited retention for regulated environments.

For organizations subject to SOC 2, HIPAA, or similar frameworks, the audit log provides the connection-level visibility and administrative action tracking needed to demonstrate access control enforcement and change management.