Audit logs

A tamper-evident log of security-relevant account activity, viewable from the console Activity view.

NevTan records security-relevant actions — sign-ins, key and SSH-key changes, 2FA events, resource creation and deletion — to a tamper-evident audit log, surfaced in the console Activity view.

Why an audit log matters

Every other security primitive on this platform — API keys, 2FA, SSH keys — controls what someone is allowed to do. The audit log is different: it's the record of what actually happened, after the fact, regardless of whether it was you or someone who shouldn't have had access. That distinction is what makes it useful in exactly the moment the other primitives have already failed or are in question — a surprise charge, a resource you don't remember creating, a key you don't recognize in the list. The log doesn't prevent anything by itself; it's what lets you reconstruct what happened and decide what to do next.

What actually shows up

The log captures the kinds of actions that matter for reconstructing "who did what, and when" on an account: sign-ins (including from new devices or locations), password changes, 2FA being enabled, disabled, or used to recover a session, API keys and SSH keys being created or revoked, and resources being created, modified, or deleted — a project deployed, a database dropped, a teammate added or removed. It is not a general-purpose activity feed for every click in the console; it's specifically the actions that carry security or account-state weight.

Read your activity

Open Activity from the account menu to see a paginated feed of your own recent actions. Use it to answer questions like "when was this API key created" or "did anyone sign in from a new device."

1. 1
   Open Activity

   From the account menu, open the Activity view.
2. 2
   Scroll or page through entries

   Entries are listed newest first, with pagination controls at the bottom once there are more than fit on one screen.
3. 3
   Narrow down what you're looking for

   Scan for the action type, timestamp, and any resource it affected to confirm exactly what happened and when.

When to actually go look

The log is worth checking any time something on the account doesn't match your own memory of it: a billing charge you don't recognize, a resource that's running but you don't remember creating it, a notification about a sign-in from an unfamiliar device or location, or simply noticing an API key in the list you can't place. In each case the log tells you the same two things — exactly when the action happened and, for sign-ins and key events, enough detail to judge whether it was really you. If it wasn't, that's the moment to revoke the credential involved (see API keys and SSH keys) and change your password, then re-check the log afterward to confirm no further activity follows.

Team and platform views

Team owners and admins can open a team's Activity view to see the full log for everyone on the team, not just themselves. Platform administrators have a separate account-wide activity view. Both are scoped to the roles that can see them.

The team view matters especially for teams where several people can create or delete shared resources — it's how an owner confirms who did what across the whole team, not just their own actions, without having to ask around after the fact.