Using the Audit Log
The Audit Log is your clinic's compliance memory. Every meaningful action — sign-ins, staff invites, role changes, recording accesses, PHI exports, support-access grants — is logged with a timestamp, the actor, and enough context to reconstruct what happened.
Where it lives
📋 Audit Log in the sidebar. Available to clinic admins and superadmins.
What gets logged
- Authentication: sign-ins, sign-outs, password changes, 2FA enable/disable, passkey add/remove
- Staff changes: invites, role changes, deactivations
- Recording access: who opened, played, downloaded, or exported a recording
- PHI exports: any file that leaves the platform (PDF handout downloads, transcript exports)
- Support access: every time an Apexmentum support agent signed into your account
- Configuration: branding changes, rubric edits, plan changes
Every entry captures: timestamp, actor (user + role), action, target (recording ID / patient ID / setting), and the source IP.
Filtering
The filter bar at the top lets you narrow by:
- Actor — one specific user
- Action type — sign-in / export / role-change / support-access / etc.
- Date range — day, week, month, custom
- Target — search by ID or name
Common queries:
- "Show me every export in the last 30 days" — filter action=export, date=last-30-days.
- "Show me everything Support did on our account last quarter" — filter action=support-access.
- "Who accessed this specific recording?" — search the recording ID.
Retention
Audit log entries are retained for the life of your account. Even if a specific recording or patient is deleted, the audit log entries about it remain (with the target masked to a hash) so you can still see the shape of activity.
Exporting
The Export CSV button at the top-right of the Audit Log page pulls the current filter results as CSV. Common uses:
- Compliance officer's quarterly review
- Providing evidence during a HIPAA incident review
- Feeding a longer-term compliance archive on your side
The CSV export itself is logged — meta, but that's the point.
When you notice something suspicious
If you see an entry you can't explain — an export you didn't make, a sign-in from an unfamiliar location, a support-access session you didn't grant:
- Change your password and, if possible, rotate 2FA.
- Email support@apexmentum.com with the entry timestamp and IDs. Include "SUSPECTED SECURITY EVENT" in the subject.
We'll investigate within one business day and, if warranted, force-sign-out affected sessions and provide a full incident report.