Skip to main content
Summand’s audit trail covers three surfaces:

​
Sharing audit records

Every share change writes a record with:
  • Timestamp (UTC)
  • Actor (user ID)
  • Action (grant, revoke, permission_change, visibility_change or lifecycle_change)
  • Subject (the user, domain or workspace that gained or lost access)
  • Role before and after the change
  • IP address and user agent of the request
If a record can’t be written after retries, a CloudWatch alarm fires. These records are kept with no expiry.

​
Application logs

Lambda functions, API Gateway and Step Functions log to CloudWatch in our AWS account. Logs hold user, resource and request IDs and fingerprints. They don’t hold SQL text, data values or chat prompts.

​
AWS activity

AWS CloudTrail records infrastructure changes across every Intelligible AWS account. The trail writes to a bucket in a separate log-archive account, with S3 Object Lock in compliance mode and log file validation turned on, so the logs can’t be changed or deleted by the accounts that produce them.

​
Identity events

Sign-in, SSO and Directory Sync are handled by WorkOS. Summand doesn’t send events to WorkOS Audit Logs, so the Audit Logs and Log Streams pages in the WorkOS Admin Portal don’t contain Summand events. Summand doesn’t stream logs to customer SIEMs.

​
Retention

For litigation hold or regulatory retrieval requests, contact support@intelligible.ai and we’ll export the relevant records for you within 5 business days.