←  All terms
A
Enterprise & Governance

Audit Log

An audit log records security- or business-relevant actions with the time, actor, and change for later review.

An audit log records security- or business-relevant actions with the time, actor, and change for later review. Clear roles, approvals, documentation, and testable rules help maintain quality across teams and websites. The concept is closely related to Governance and Role-Based Access Control.

Read more

Governance

Role-Based Access Control

ISO 27001

Webflow Enterprise

FAQ

Audit Log

What data protection aspects apply to an audit log?
An audit log contains personal data such as user names and is therefore subject to data protection rules. Retention period and access should be defined and documented in line with a clear purpose. How long entries are actually kept depends on risk and legal requirements and is settled internally with privacy and legal teams.
When is an audit log expected in an enterprise setting?
It is expected when many people work on websites, approvals must be provable, or security reviews such as ISO 27001 assessments are coming up. An audit log does not replace a role concept but demonstrates that it is being followed. For small teams with few changes, the benefit is smaller.
How does an audit log differ from a version history?
A version history stores content states so they can be restored, while an audit log documents who triggered which action and when. The log also covers events that change no content, such as permission grants. For traceability and accountability the log is decisive, for recovery the history.
What should an audit log capture at a minimum?
It should record the actor, timestamp, action, and affected object, plus the previous and new value for changes. Typical events are sign-ins, permission changes, publications, and deletions. Without these details, an incident cannot be reconstructed later. Entries should be stored in a tamper-resistant way.