Audit Trail
Every change to your company file is recorded in the Audit Trail (Company → Audit Trail). It is what lets a CPA, auditor, tax authority or lender trust the books: every number can be traced to who changed it, when, and what it replaced.
What's recorded
Each event stores:
| Field | Notes |
|---|---|
| Timestamp | When the change happened |
| Event type | For example a journal entry created, an account modified, a setting changed, a user login |
| Entity type and ID | The record that changed — journal entry, account, contact, setting, fiscal year or period, reconciliation, recurring transaction, and so on |
| User and actor type | Who made the change, and whether it was a person, an AI assistant, or an integration |
| Before / after | A snapshot of the record before and after the change (creates have no "before", deletes no "after") |
| Metadata | Context such as app version and machine |
| Sequence number and hash | Each event is numbered and chained to the previous one by a cryptographic hash |
Changes made through the REST API or by an AI assistant also record the session they came from and, when supplied, the reason. An AI correction shows as one sentence with the value before and after.
Refusals are recorded too: an attempt without permission, a blocked delete, or an attempt to remove the last Admin. So is viewing a vendor's full tax ID.
Why it can't be edited
The Audit Trail is append-only and tamper-evident. The company file itself refuses to update or delete an audit entry — even for an Admin — and the hash chain means a removed or altered entry would break the chain. Ledger Health (Reports → Ledger Health) checks the chain and lists any older entries that break a double-entry rule. Editing a transaction adds a new entry showing the edit; the earlier entries stay. Entries are kept for the life of the company file.
Two consequences worth knowing:
- Restoring a backup restores the trail to that point. Events after the backup are not in the restored file; the restore itself is recorded. Cloud backup operations are also logged separately on your computer, so they survive a restore.
- History starts when the company file does. Importing from QuickBooks® or another product records the import, but not per-transaction history from the old system.
Viewing the Audit Trail
Open Company → Audit Trail. Each row shows When (in your local time), User, What happened — including the document number — and the Amount. Filter by Record (transactions, users, accounts, settings and so on), Document (invoices, bills, checks…), Show (everything, refusals, role changes), Start Date and End Date, then click Apply. Click a row to see its detail, before and after. Export CSV saves what's shown. An active company file can have many thousands of entries; the filters are what make it manageable.
The Audit Trail shows the whole company file, so it needs a role that can see the full books. In a multi-user company file, every Admin can see events about every user — tell your team.
AI and integration changes
Company → Activity Log (AI & Integrations) shows only the changes made by AI assistants and integrations, grouped by session. Filter by AI, Integrations or All. Undo all on a session puts back everything that session did, newest first; a change that was edited again since is skipped, not overwritten. See AI assistants.
Using it in reviews and audits
The Audit Trail, together with attachments for source documents, answers the questions reviewers ask:
- SOC 2 or internal controls — changes are logged, immutable and retained; look for user-role changes, settings changes, and fiscal period close and re-open events.
- Tax audits — tie a sample of transactions to their source documents and show they were not altered afterwards.
- Sales-tax audits — show when tax codes and rates were created or changed, alongside the Sales Tax liability report.
- Lenders — the technical evidence behind a statement that the records are tamper-evident; your CPA writes the assertion.
For programmatic access, the REST API exposes GET /audit-log.
Related
- General Ledger — the append-only journal the Audit Trail sits beside
- Cloud Backup
- Multi-User — users and roles