Audit log

Every organization has an audit log: a record of what happened, who did it, when and from which address. Records are linked in a hash chain, so a changed, deleted or inserted record shows up when you verify the log.

What it records

• sign-ins, new devices, sessions and second-factor changes;
• invitations, confirmations, removals and role changes;
• environment access changes, saved versions, key rotations, and deliveries of keys and file copies;
• machines: creation, enrollment codes, enrollment, reused codes, approval, sign-ins, lease changes and revocation;
• service tokens and their CI bindings;
• share links: creation, opening and revocation;
• access profiles and access requests;
• denials and rate limits;
• network lists, network rules, break-glass access and machine passes.

Secret values never appear in the log. The server doesn't know them.

Client-reported events

When someone shows, copies or exports values in the web app, their browser sends a signed event to the log. These events are marked Client-reported, because the server can't observe them itself.

The delivery record

Separately from the log, the server keeps a record of which versions of which environment it delivered to whom: first and last delivery, how many times, and the last address. That record is the basis of the exposure report in the member removal wizard and of the list of received versions on a machine's or token's page. Each version delivered in the last 90 days is listed individually. Older entries are summarized per key epoch.

Reading the log

Open Audit log. Filter by person or machine, action, environment, and a period from and to. Each record shows the actor, the address, the time and its number in the chain.

Owners and admins see the whole log. Members see their own events.

Events that happen to your account outside any organization, such as deleting an organization you owned or recovering access with a recovery code, go to your account's own log.

Verifying integrity

Each record contains the hash of the previous one. Choose Verify integrity, available to owners and admins, to recompute the chain. The answer says how many records were checked, from which record, and whether the chain is intact. If it isn't, it names the first broken record.

The tail of the log

A chain can't show by itself that its latest records were removed. Once a week, write down the number and hash of the latest record somewhere outside Crunu, such as a ticket or a note. Verification shows both. If a later check shows a lower last number, or a different hash for the same number, the log was altered, which means the server or its database was tampered with.

Exporting

Export JSONL downloads the records exactly as their hashes are computed. An outside program can verify the export: remove the hash field from a record, canonicalize it, compute SHA-256, and compare it with that record's hash and with the next record's prevHash.

Retention

By default the server keeps the log for 365 days. A self-hosted server sets this with AUDIT_RETENTION_DAYS, where 0 means forever. An owner can extend the period for their organization, to between 30 and 36,500 days or forever, but can't shorten it below the server's setting. Change it in Organization settings, under Retention period.

Cleanup removes records older than the period once a day. It leaves a checkpoint with the number and hash of the last removed record, and writes an event about the trim into the chain itself. Verification starts from the latest checkpoint, so it stays complete.

If you need the log for longer, for an audit or a regulation, export it before the period ends. An export that doesn't start at the first record begins with the hash of the checkpoint.

Typical uses

• Someone left. Filter by that person to see what they did, and use the exposure report to see what they received. See Offboarding a teammate.
• A token may have leaked. Filter by the token to see its sign-ins, addresses and denials.
• An auditor asks for evidence. Verify the chain, export JSONL, and keep the latest number and hash on record.

Alerts are built on top of the same events. See Alerts.