What is recorded
Sign-ins and failed sign-ins, two-factor changes, team and brand role changes, invitations, network connections and disconnections, posts, approvals and client-portal decisions, agency settings, billing events, API token and webhook events, report share links, privacy operations, Content Studio actions and analytics access. Each event carries the person, their address and browser, the time, and — when iUtils support acted in someone's name — the person who really acted.
Reading it
Settings → Audit log is open to agency owners and admins. Narrow it by category, by person, by date range, or by a word in the event; the filters are in the address bar, so a view can be bookmarked or sent to a colleague.
Exporting it
Export the current view as CSV or JSON Lines for an auditor or a SIEM. The export streams every matching row, and the export itself is written to the log as an event, because handing the log to someone is an access to it.
How long it is kept
Security and sign-in records are kept for 24 months and then deleted by the nightly retention job. Records that prove an erasure was carried out are kept beyond that.