SemAgentAudit Log
Admin Panel → Audit Log shows who did what in your account — so you can trace permission changes, answer "who did this?" and prove that personal data requests were handled.
Search and filters
The box at the top searches the loaded entries by action, person, target or IP address. The filter button next to it opens a panel:
- Severity. Critical: something broke or is at risk (malware in an upload, a channel connection error, email sending paused). Warning: actions that cannot be undone, lower protection or widen permissions, and personal data requests (failed sign-in, user deletion, role change, turning off two-step verification, customer record deletion…). Info: everything else.
- Area. Personal data requests, Team and roles, Sign-in and security, Support requests, Widget, Conversations, Customers, Channels, Email sending, Campaigns, E-commerce, Help site.
- Who. The user who did it; system for automatic actions and support for actions by SemAgent support.
Each option shows how many entries it has in the selected period, and the badge on the button shows how many filters are on. Filters work on every entry in the period, not only on the ones loaded on screen. The list loads 200 entries at a time; press Load more at the bottom for the rest. The period can be the last 30 days, 90 days, 1 year or 3 years.
Entry details
Click a row to open its details: what happened, the time (in your browser's time zone and in UTC), who, the target and the IP address. The tags show the technical name of the action (for example customer_profile.deleted) and its area, which helps when you write to support.
Personal data requests and the erasure certificate
When a customer record is deleted (Customers › Deleting a record) or Shopify sends a customer erasure notification, the row shows what was erased and what was kept, with counts. Example: erased: 1 customer profile, 3 order records, 2 AI memory records, 2 conversations, 46 messages · not erased: 1 opt-out.
When you open these rows, an Erasure certificate (PDF) button appears. The certificate is a single page in the panel's language (English or Turkish) and contains:
- the data controller (your company) and the service provider (SemAgent),
- the date and time of the operation (in your time zone and in UTC), the user who performed it or the Shopify notification, and the data subject,
- the types and counts of the erased records, and the records not erased with the reason,
- a verification code.
You can attach the certificate to your reply to the person who asked, or keep it for your own records. The verification code ties the certificate to the audit record: if any value in it is changed, the code no longer matches. You can have a certificate verified at [email protected] with its record number and code.
Keep your certificates. Data protection rules may require you to keep records of erasures for years (Turkey's regulation on erasure asks for at least three). The audit log is kept while your account is open and the panel shows the last three years; if you close your account, the audit log is deleted too, so download the certificates you need first. Erased data may remain in encrypted database backups for at most 370 days.
What gets recorded?
| Area | Recorded events |
|---|---|
| Users | Created, deleted, role changed, name or phone changed, agent access turned on or off. |
| Invitations | Sent, cancelled, resent. |
| Roles | Permission matrix saved, reset to defaults, custom role created or deleted. |
| Support requests | Opened, closed, reopened, attachment downloaded. |
| Sign-in | Successful and failed attempts; sign-ins with two-step verification and wrong verification codes are marked as such. |
| Two-step verification | Turned on, turned off, new recovery codes, an admin's reset, and making it required for the team or lifting that (Account security). |
| Widget | A visitor blocked or unblocked, with the masked value (Conversations); messages stopped by the spam filter; the store sign-in identity key rotated or removed. |
| Conversations | Transcript sent; conversation card created, edited or removed; a conversation added to a customer record or detached from it; conversations marked as the same topic and the mark removed; a conversation continued on another channel. |
| Customers | Order and consent syncs, consent requested and recorded, order archive cleared and its retention changed, records merged and merges undone, identities added or detached, a customer record deleted. |
| Channels | WhatsApp, Instagram and Telegram connected, disconnected, settings changed and connection errors; Instagram comments replied to, hidden or deleted. |
| Channel and AI turned on or off, forwarding address renewed; sender addresses added, removed, verified or made default; sending method changed, Gmail / Microsoft connected, SMTP saved. | |
| Campaigns | Created, edited, deleted; outbound and test sends. |
| Discount codes | Code created or stopped; the assistant's sharing settings. |
| E-commerce | Store linked; store permissions and the order-details code turned on or off; Shopify's data deletion and data request notices. |
| Security | Malware found in a file your team uploaded (a logo or a knowledge-base file); the file is removed. |
| Help site | Settings changed. |
Every change gets its own row. A single "user updated" row would not answer the question "what changed?". Name and phone changes appear as User details updated, naming the field that changed — the phone number itself is never written to the log.
The period before recording
The screen tells you when recording started. That matters: an empty list does not mean "nothing was done", it means "there was nothing to record yet". Things done before recording began were not undone — they were simply not recorded.
The audit log cannot be deleted
There is no endpoint that deletes or edits the log — not from the panel, not from the API. An editable audit log is not an audit log. Secrets such as passwords or keys are never written into it either.
Your account only
Every entry belongs to one account and is visible only to that account's users. Another customer's actions never appear in your list.
One detail about failed sign-ins: an attempt is recorded only if the email resolves to a user. If it does not, we do not know which account it belongs to — and therefore do not know whom to show it to.