Audit Log
Track content changes with a first-party audit trail for editors, reviewers, and administrators.
Plugin
Audit Log
Track content changes with a first-party audit trail for editors, reviewers, and administrators.
Product Details
- Category
- Operations
- Status
- available
- Version
- Included in beta
- Price
- Included in beta
- License
- MIT
- Release Date
- TBD
- Compatibility
- EmDash CMS beta preview
- Maintainer
- EmDash CMS Team
Links
Audit Log exists because serious editorial teams need to know who changed what, when, and in what context—especially once more than one person touches content or compliance asks for traceability. The implementation lives in packages/plugins/audit-log.
Installation
- Enable Audit Log from the EmDash admin plugin list, or integrate it from source during development.
- Confirm storage backing the log meets your retention policy (database tables, Workers KV, or whatever the plugin uses in your release—check the README).
- Grant read access to audit views only to roles that need them; write paths should stay system-controlled.
Configuration
Typical options include:
- Events to record — creates, updates, deletes, publishes, and possibly login or plugin actions.
- Retention windows — how long entries stay online versus archive to cold storage.
- PII redaction — whether user identifiers are full email, internal IDs, or hashed values.
Example (conceptual): a regulated marketing team might retain audit entries for 24 months, export monthly to an SIEM, and restrict the in-app audit UI to administrators and compliance officers only.
Usage scenarios
- Multi-editor workflows — settle “who published this?” disputes with evidence instead of chat logs.
- Incident response — trace a bad rollout or mistaken edit back to a change window.
- Customer audits — demonstrate control over content changes for SOC 2–style questionnaires when paired with your broader security story.
Operational tips
- Test restore and export paths before an auditor asks for them.
- Coordinate with Webhook Notifier if you need real-time alerts on sensitive content types.
- Document whether audit entries themselves are immutable; if not, protect that surface from tampering.