Taking the audit log out is itself an entry in it.
Export the log for a date range and the export appears in the log: who took it, how many rows, and the filters they used. It is the detail a security reviewer asks about, and most products cannot answer it.
The audit log is HQ, and only Super Admins and Comms Admins can open it.
- 09:41Megan NashEXPORTaudit_log5,000 rows · 1 Jan to 30 Sep
- 09:12Dr Tessa PalmerREVOKE_SESSIONSimon Naylor192.0.2.44 · Chrome on Windows
- 08:47Simon NaylorLOGINsession198.51.100.9 · Safari on iOS
- 08:30Dr Tessa PalmerUPDATEUpdated hand-hygiene protocol192.0.2.44 · Chrome on Windows
The top row was written by the export that produced the file. Nobody typed it, and no code path edits an entry once it is written.
There are four roles, and no others.
A ward lead, an HR partner and an auditor are jobs, not permissions. A Super Admin owns the workspace, a Comms Admin does the communications job, a Space Admin is scoped to the Spaces they run, and everybody else is an Employee. Two of the four reach the console at all.
| Capability | SuperAdmin | CommsAdmin | SpaceAdmin | Employee |
|---|---|---|---|---|
| Billing and the plan | Super AdminYes | Comms AdminNo | Space AdminNo | EmployeeNo |
| API keys and webhooksHQ | Super AdminYes | Comms AdminNo | Space AdminNo | EmployeeNo |
| Invites and access codes | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| Announcements to everyoneCommand and HQ | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| The moderation queue | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| The engagement dashboard | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| Surveys and segmentsCommand and HQ | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| The executive dashboardHQ | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| The audit logHQ | Super AdminYes | Comms AdminYes | Space AdminNo | EmployeeNo |
| Managing a Space | Super AdminYes | Comms AdminYes | Space AdminTheirsOnly the Spaces they run | EmployeeNo |
| Exporting their own data | Super AdminYes | Comms AdminYes | Space AdminYes | EmployeeYes |
Rows without a plan tag are on every plan. A role is chosen when the invitation is sent, and there is no screen that changes it afterwards. A person's job title is written on their profile and grants nothing.
Three people, and what each of them gets.
- Dr Tessa PalmerHead of clinical governance
Revokes a session when a phone is lost, and knows that the revocation is in the log with her name on it.
Comms Admin - Megan NashExternal auditor
Asks for the log for a date range, gets a CSV, and finds her own request in it as the first row.
- Simon NaylorRegistered nurse
Appears in the log when he signs in, and cannot open it. There is no console for an employee.
Five things, and the plan each one needs.
- People and access
Invite by email or a shareable join link with a QR code, bulk import up to 100 people from a CSV, four roles, departments, and session revocation.
Every plan - Single sign-on
Google and Microsoft sign-on. Email and password sign-in stays available on every plan, including Spark.
Command and HQ - The moderation queue
Posts and images flagged by the safety classifiers arrive in a queue for an administrator to act on, on every plan rather than as a paid add-on.
Every plan - The audit log
Sign-ins, session revocations, password and two-factor changes, content changes, plan and billing events, member invites, deactivations and data exports. Each entry carries the actor, the action, the timestamp, the IP address and the user agent, and filters by action, resource type and date range.
HQ - Export that records itself
Entries export to CSV for a chosen range and filter, and the export writes an entry naming who took it, how many rows, and which filters they used.
HQ
What the audit log is not.
Every line here traces to something in the code, including the parts it would be easier to leave out.
- Append-only is not tamper-evidence
There is no hash chain, no cryptographic signing and no write-once storage. The application has no path that edits an entry’s actor, action, target or time once written, and that is an application property rather than a storage guarantee.
- The application can still delete rows
Deleting is deliberately left available to the application role, because purging a tenant has to remove its audit rows too. So this is not protection against a compromised platform operator, and the page will not pretend otherwise.
- A failed write is dropped, not retried
If the audit write itself fails, the failure is recorded to the server log and swallowed rather than rolling back what the administrator was doing. That is a deliberate choice, and it means the log is best effort under database failure.
- It does not record reading
The log covers administrative and account events. There is no entry for who opened a given post or article, because nothing in the product records that.
- Some sign-in failures never reach it
A sign-in that Firebase Auth refuses before the request reaches Kayden Connect, such as an unknown account or a wrong password, leaves no entry. The refusals that do appear are the ones your own workspace policy caused.
- An export is five thousand rows at a time
One request returns at most five thousand entries and exports are capped at five a minute, so a full year for a busy workspace is several paged requests rather than one button.
- SAML and SCIM do not exist yet
SAML 2.0 single sign-on and SCIM 2.0 provisioning are not available today; both are planned for a release after launch. There is no SAML or SCIM code in the product, and any dated commitment on them would be a sales promise rather than a shipped capability.
What else the console decides.
- The recordAn acknowledgement and an audit entry are different records. One is a person confirming a message, the other is an administrator changing something.
- AnalyticsThe dashboard counts what people did with content. The audit log records what administrators did to the workspace.
- Spaces, chat and peopleRoles, departments and Space membership decide who can reach what, before any of it reaches the log.
Read the log, then export it and watch the export appear.
Kayden Connect is invitation-only before launch. Tell us about your workforce and we will show you the demonstration workspace.
Request early access- HQThe audit log and its export.
- Self-auditingTaking the export writes a row naming who took it.
- Four rolesSuper Admin, Comms Admin, Space Admin, Employee.