Audit log

Every prompt, query, automation run, and admin action is logged. Export for compliance, governance, or cost attribution.

Last updated 2026-05-09

Arcus logs every action your tenant takes. Prompts, generated SQL, query results metadata (no PII), automation runs, comments, share links, settings changes — all of it goes to the audit log.

You don't have to opt in. The log is on by default for every tenant.

What's logged

Every entry has a consistent shape:

Tenant — your tenant ID.
User — who did it (or system for automated actions).
Action — a dotted name like chat.message, connection.create, automation.run, share.create.
Resource — what was acted on (a thread, a connection, a metric).
Metadata — action-specific JSON. For chat messages, this includes the prompt, the SQL generated, the row count of the result, the trace ID, and the cost. For settings changes, it includes the before/after diff.
IP address — the request's source IP (or null for system actions).
Timestamp — UTC.

Sensitive fields are stripped before the entry is written. Connection credentials are never logged. Generated SQL is logged but PII columns can be marked redact-on-read in Settings → Audit log → Redaction rules.

What isn't logged

The actual data rows returned by queries. We log row counts, byte counts, column names, and freshness — but not the values. If you need full data lineage at the row level, contact us.
Connection credentials. We never log secrets, full or partial.
Other tenants. Even our own ops team can't see your audit log without a support escalation flow.

View the log

In Arcus, Settings → Audit log. The view shows:

A filterable table — by user, action, resource type, time range.
A search box — full-text across action names and metadata.
An expandable detail view per row — full metadata JSON.

Common filters:

Show me everything user X did last week.
Show me all changes to the semantic layer.
Show me every blocked query in the last 30 days. (See Connect Snowflake for the cost-cap behavior that logs as query.blocked.)

Export

Three export paths:

CSV

Click Export → CSV. Downloads a flat file with all the columns above, filtered by whatever's currently in view. Use for ad-hoc analysis.

API

GET /api/audit-log?from=2026-04-01&to=2026-04-30&format=ndjson

Authenticated with an API key (generate in Settings → API keys). Returns NDJSON — one event per line. Paginated; follow the next link header.

Useful for piping into your own SIEM (Splunk, Datadog, Elastic).

Streaming via webhook

Subscribe to the audit.event webhook event (see Webhooks). Every audit entry is delivered to your endpoint in near-real-time as it's written.

For SOC 2 / ISO 27001 compliance, this is usually what you want — events stream into your evidence-collection system without a daily export job.

Retention

Active retention — 13 months in the live database. Filterable, searchable, exportable.
Cold retention — additional 6 years in cold storage (S3 with object lock). Restorable on request, typically within 24 hours.

Tenants on the Enterprise plan can extend active retention to 7 years.

If you need to delete an audit entry (e.g. it captured PII due to a misconfigured redaction rule), file a request from Settings → Audit log → Compliance. Deletion is logged itself in a separate immutable compliance log.

Common patterns

Cost attribution

Filter to chat.message and group by user. The cost_usd field in metadata sums to that user's monthly LLM + warehouse spend. Useful for chargeback to teams.

Suspicious activity

Filter to connection.* actions. Settings changes to data sources are rare events — anomalous frequency is worth investigating.

Who saw what

For sensitive data investigations, filter to chat.message with a metadata search for the relevant table or metric. You'll see every user who queried it, their prompt, and the time.

Compliance evidence

For SOC 2 audits, the API export with filters by date range gives you a complete record of access. Auditors typically want:

All sign-ins (action auth.login).
All admin changes (settings.* and connection.*).
All data access (chat.message).
All share-link creations (share.create).

The export is structured to drop into evidence-collection tooling like Drata or Vanta.