Skip to main content
The audit log gives you a tamper-resistant history of the actions your staff take across your account: who did what, to which resource, from where, and whether it succeeded. Use it to investigate changes, meet compliance requirements, and answer questions like “who cancelled that order?” or “when was this menu item updated?”.
The audit log is restricted to account owners and admins. Staff on other roles will see a “restricted” message when they try to open it.

​
Where to find it

1

Open Reports

In the dashboard, go to Reports → Logs.
2

Open the Audit Log

Under the Security section, select Audit Log.
3

Search and filter

The most recent events load automatically. Narrow the results with filters, or export what you see to CSV.

​
What gets recorded

Each entry captures the full context of a single staff action: Selecting a row expands a detail panel with the request method, path, route, IP address, user agent, request ID, and trace ID, along with the error type when an action failed.

​
Which actions are logged

  • All changes are recorded — anything that creates, updates, or deletes data (including actions like archiving, cancelling, restoring, or publishing).
  • Sensitive reads are recorded — viewing or downloading reports, exports, invoices, and statements. Opening the audit log itself is recorded as a read, and exporting it is recorded as an export.
  • Routine reads (browsing lists, opening detail views, background polling) are not recorded, to keep the log focused on meaningful activity.
Actions taken by customers placing orders and by API keys are outside the scope of the audit log — it focuses on staff actions in the dashboard.

​
Searching and filtering

The audit log uses a faceted search bar. Add one or more filters and click Apply; active filters appear as removable pills. Available facets: By default the log shows the last 30 days. Results are paginated — use Load more to fetch older events. You can clear everything with Clear all.
Combine facets to zero in on an incident — for example, filter by Actor and Action: delete to see everything a specific user removed.

​
Exporting to CSV

Click Export to download the currently filtered results as a CSV file (with the same filters and date range applied). This is handy for sharing with auditors or archiving outside storekit.
Exports are capped at 50,000 rows. If you hit the cap, narrow the date range or add filters and export in smaller batches.

​
Privacy and data handling

The audit log is designed to record what changed without capturing sensitive contents:
  • It stores the names of the fields involved in a change (e.g. “price, availability”) — never the actual values that were submitted.
  • Field names that look sensitive (passwords, tokens, keys, card details, PINs, and similar) are automatically dropped and never recorded.
  • Records are append-only: entries are never edited or individually deleted, so the history stays trustworthy.

​
Retention

Audit entries are retained for 30 days by default. Enterprise accounts can request a longer retention period.
Only account owners and admins. Other staff roles cannot view or export it.
The log intentionally records changes and sensitive reads (reports, exports, invoices, statements) only. Everyday browsing and background requests are excluded so the log stays focused on meaningful activity.
No. It records which fields were involved in a change, but not the submitted values. Sensitive field names are dropped entirely.
Entries are kept for 30 days by default. If you need longer retention for compliance, contact our team.
You can export the filtered results, up to 50,000 rows per export. For larger ranges, split the export into smaller date windows.

Related topics

Integrations OverviewPLU Mapping GuideManager PINsSecurity PolicyTesting Webhooks