> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit trail

> Every publish, rollback, restore, and edit — logged with actor, time, and reason.

Some deployments matter for compliance. Some matter because the team needs to know who changed what and why. Either way, the audit trail is the record.

## What's audited

Nora records:

* **Every publish** — who, when, from which Draft, release note, resulting version ID.
* **Every rollback** — who, when, from → to versions, reason.
* **Every restore-Draft** — who, when, which version was restored.
* **Every access change** — permission grants and revokes.
* **Every secret rotation** — who rotated which secret (value never logged).
* **Every approval decision** — approver, timestamp, verdict, comment.
* **Every improvement deploy** — improvement ID, cluster it addressed, target version.

Edits within Draft are not individually audited (auto-save churn would flood the log). The final Published version and its diff from the prior version *are* audited.

## The audit view

**Flow → Audit**. Reverse-chronological list. Each entry:

* **Actor** — name and email.
* **Action** — publish / rollback / etc.
* **Target** — Flow, version, block, secret.
* **Details** — the specific change, release note, reason.
* **Source** — UI / CLI / API / webhook.
* **IP / user agent** — for the UI and CLI.
* **Signature** — every audit entry is signed; tampering is detectable.

Filter by actor, action type, date range.

## Workspace-level audit

For workspace-wide changes (member added, plan changed, connector rotated, etc.), a separate **Workspace audit** page collects them. Owners only.

## Export

Every audit view is exportable:

* **CSV** — flat table.
* **JSON** — full detail per entry.
* **PDF** — printable summary, one entry per row.

Exports are signed with a workspace-level signature so external auditors can verify authenticity.

## Retention

Default: 1 year of audit history retained. Enterprise plans: configurable retention (up to 7 years or indefinite). Configure under **Workspace settings → Audit retention**.

Older audit entries are archived (still queryable via export) but not shown in the default view.

## Immutability

Audit entries cannot be deleted, edited, or reordered. If an entry is wrong, add a corrective entry — the original stays. This is what makes the audit trail trustworthy.

## SIEM integration

For orgs with a security operations center, forward audit events to your SIEM:

* **Slack / Discord** — webhook notifications on important events (publish, rollback, secret rotation).
* **PagerDuty** — page on rollback or auto-rollback triggers.
* **Splunk / Datadog / SumoLogic** — JSON stream via HTTPS.
* **Custom webhook** — POST every audit event to your endpoint.

Configure under **Workspace settings → Audit forwarding**.

## Compliance modes

For workloads under specific compliance regimes (SOC 2, HIPAA, GDPR), turn on **Compliance mode**:

* Every action requires a reason (not optional).
* Audit retention forced to the compliance-required duration.
* Certain destructive actions require multi-sign approval.
* Data export requires explicit approval workflow.

Compliance mode is per Flow. Turning it on is a one-way transition — turning off requires an Owner + written justification.