Audit log

OpsMerge logs every meaningful action — who did what, when, against what. The audit log is read-only and tamper-evident: entries can't be edited or deleted by users, even by Owners.

Where to find it

Settings → Audit log.

The default view shows the most recent 100 entries across the whole tenant. Filter by:

• User (which OpsMerge user performed the action)
• Action type (login, ticket update, contract change, etc.)
• Object (a specific ticket ID, client ID, agent ID, etc.)
• Date range
• IP address or User-Agent

Each entry includes a JSON diff for changes — so for "Updated ticket #1234" you see exactly which fields changed and from what to what.

What's logged

Anything that creates, modifies, deletes, or exfiltrates data. The non-exhaustive list:

• Sign-in (success, failure, MFA challenge, MFA failure, password reset request, magic-link sent)
• User created, modified, role changed, removed
• API key created, used, revoked
• Client created, modified, archived, merged
• Contact created, modified, deleted, portal access granted
• Ticket created, status changed, assigned, merged, deleted
• Contract created, modified, voided
• Invoice created, sent, voided, paid
• Settings changes (every Settings → tab change)
• Integration credentials saved or rotated
• Agent script execution (which user triggered it, against which endpoints, the command itself)
• Remote control session started/ended (which user, which endpoint, session duration)
• Bulk operations (apply tag, merge, archive, etc.)
• Export operations (CSV exports of any list)

What's deliberately not logged:

• Read operations on most lists. We log who read sensitive things (e.g. opening a specific ticket's audit history, downloading an invoice) but not "looked at the ticket list at 9.42am".
• Heartbeat-style background events (agent check-ins, polling).
• Internal system events (NATS reconnections, etc.) — those are in our platform logs, not the user-facing audit log.

Retention

Audit log entries are retained for 365 days by default. Older entries are pruned monthly.

If you have a compliance reason to retain longer (your MSP is itself audited, or you serve a regulated industry), you can extend retention via Settings → Audit log → Retention. Options: 1 year (default), 2 years, 5 years, 7 years.

Longer retention has no cost impact on your subscription but does add to the platform's storage usage. We're transparent about that — if you push retention to 7 years, expect us to mention it during reviews.

Retention extension is forward-only

Setting retention to 7 years today doesn't retrieve entries deleted under the 1-year policy yesterday. Pruning is one-way. Decide your retention policy when you first set up OpsMerge, then leave it alone.

Exporting

Settings → Audit log → Export.

You can export:

• The currently-filtered view.
• A specific date range.
• The entire log (subject to retention).

Format: CSV or JSON.

Exports themselves are logged ("User X exported N audit entries for date range Y") — so there's a paper trail of the paper trail.

Why export?

Three common reasons: your MSP's own annual audit; a client compliance review requesting all actions taken against their account; an incident investigation where you want to share entries with a third party without giving them OpsMerge access.

Per-client audit views

Sometimes a client asks "show me everything your team did against my account in the last month". You can get this without exposing other clients:

1. Client → Audit tab.
2. Default filter is "this client only".
3. Export from there.

You can also share a read-only audit view with a portal user (give them the Portal: read audit log permission). They see only their client's entries.

Tamper evidence

Each entry includes:

• An immutable timestamp set by the platform (not by the actor).
• A cryptographic chain hash that links it to the previous entry.
• The IP address and User-Agent of the actor's request.

The chain hash means a tampered entry is detectable — if someone tried to alter or remove an entry by direct database access, the chain would break and verification (run on every export, and continuously in the background) would flag it.

If you ever see a "Audit log integrity warning" in OpsMerge, stop and contact us immediately. We treat that as a P1.

Common questions

Can I delete an entry I made by mistake? No. The point of an audit log is that it's not editable. If you took an action you didn't mean to, take a compensating action and that one gets logged too — both are visible.

Can I see what someone tried to do but failed? Yes. Failed attempts (denied logins, permission-denied actions) are logged with outcome: denied and the reason.

The log shows an action against my account I didn't do. Treat it as suspicious. Check the IP and User-Agent — if they don't match any device of yours, your account may be compromised. Reset your password, revoke all sessions, contact support. We'll help you investigate.

Next

• API access — every API call is also audited
• Users & roles — controlling who can do what (and therefore what shows up in the audit log)