Audit log

The audit log answers "who gave this person that access, and when?" — and "who changed that setting?". It records every membership, group, permission, role and status change in your agency; every change to its settings, approval rules and access codes; changes ROK makes to your plan, limits or agency details; and every time someone from ROK support enters your agency. Open it from Organization → People & access → Audit log; the tab appears for people with Manage users or Manage groups, and the database returns your agency's entries only to holders of one of those two permissions (everyone can see the entries about themselves — see below).

The log is read-only for everyone. Entries are written by ROK itself as changes happen, and nobody in your agency can edit or delete one — only the retention rule at the end of this page removes them. It covers your agency only; another agency a member belongs to keeps its own log.

It is not the history of your content. Edits, reviews and publishing are recorded on each item in the editor, not here.

Activity (last 30 days)

A chart of how many events happened each day over the last 30 days, headed with the total and how many fell in the last 7 days — for example "42 events · 9 in the last 7 days". The chart reads at most the 2,000 most recent events in that window.

Top actions & actors beside it lists the five most frequent kinds of event and the five people who made the most changes in the same 30 days.

The entries: who changed what, and when

Entries are newest first, 50 to a page, with previous and next buttons and a page count underneath. "No activity recorded." means nothing matches the current filter.

Permission changes in Detail use the permission's key — "Granted content.publish to Reviewer". The Permissions tab shows each key beside its plain name.

Who the By column names

Some changes are carried out by ROK's server on an administrator's behalf — inviting people, removing, suspending or reactivating a member, resetting a password or two-factor, changing your subscription. These name the administrator who asked for them. Removing someone from your agency still shows Removed from tenant twice — once from the database's own record, once from ROK's server — both under that administrator's name.

When nobody was behind a change, By names what made it instead: Stripe (your subscription changed at Stripe — a renewal, a failed payment, a cancellation taking effect), Scheduled job (for example a sponsored plan reaching its end date), or Service. System appears on older entries recorded before ROK began naming the administrator, and on anything else with no actor.

Filter and export

The All actions list narrows the table to one kind of event. The chart above is not affected by it.

Export CSV downloads access-audit.csv with every entry matching the current filter — not just the page on screen — with the columns Timestamp, Action, Actor and Description. A note beside the button says how many entries the file holds. The export stops at the 10,000 most recent matching entries and tells you when it has: narrow the filter to capture the rest. The button is disabled when nothing matches.

What is recorded

A few notes:

• Access codes never appear in full. An entry shows the code's label and its last four characters — enough to tell two codes apart, not enough to use one. Each time someone joins with a code, Joined via access code records it; the code's use count changing is not itself an entry.
• Plan & limits entries list each value that changed — plan, seat, content and storage caps, billing status, cancellation, billing interval, sponsorship — with the old and new value.
• Badges awarded or revoked by hand also land in this log. They show their internal names, badge.awarded and badge.revoked, and the All actions filter does not list them.
• Re-sending an invitation produces no entry. Revoking one records Removed from tenant, because it takes the pending member out of your agency.

ROK support visits

ROK's platform administrators are not members of your agency. When one of them needs to look inside it — usually because you asked for help — they open a support visit, and both ends of it are written here:

• Entered tenant (platform admin) names the person, the reason they had to give before entering (it is required), whether the visit is view only or allowed to make changes, and when it ends.
• Left tenant (platform admin) says how the visit ended — they went back to ROK's console, switched elsewhere, signed out, or reached the four-hour limit — and how long it lasted.

What a visit can do is fixed by ROK's database, not by the person's goodwill:

• View only reads what your staff can read and changes nothing.
• Make changes can also edit content, tags, templates, settings, branding and badges — and each such change appears in your logs under that person's name like anyone else's.
• No visit can ever publish, unpublish or approve content, delete content, send anything to your operators' phones, change who has access (people, groups, access codes), touch billing, or award badges.
• A visit ends after four hours at most. Coming back means a new visit with a new reason.

A ROK administrator who is a member of your agency — because you invited them — appears as an ordinary member, with only the groups you gave them.

Who else sees these entries

Each member can see the entries about themselves on the Activity tab of their own Account settings, and a member's entries also appear in the Activity card on their detail page.

How long entries are kept

Entries are kept for two years, then deleted by a nightly job, as ROK's Privacy Policy states. Export anything you need to keep for longer.