5. Audit trail and compliance

~5 minute read. Nothing to switch on — e.audit has been recording since your first sign-in. This page is about reading and exporting it.

Step 5: Open e.audit

Go to https://app.eworks.cloud/audit. Admins and Viewers have access.

[Screenshot: Audit table with filter bar, event rows, and an expanded event detail drawer]

What is logged

• API calls — every chat completion, agent run, tool invocation, knowledge query, and data export, with model, tokens, latency, and result.
• User actions — sign-in and sign-out, MFA changes, invitations, role changes, removals, connector and settings changes.
• Cost events — token usage priced per model, attributed to a user, an agent, and a workspace.
• Security events — failed sign-ins, lockouts, denied permissions, revoked sessions.

Each event carries who (user or agent), what, when (UTC, millisecond precision), where from (IP, user agent), which resource, and a correlation ID that ties a chat message to the model call and the cost line it produced.

Filters

Filter by date range, user, action type (chat.*, agent.*, member.*, auth.*, export.*), resource, and outcome. Filters are encoded in the URL, so a filtered view is shareable — handy when handing an auditor exactly the slice they asked for.

curl -s -G https://api.eworks.cloud/v1/audit/events \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data-urlencode "from=2026-07-01T00:00:00Z" \
  --data-urlencode "to=2026-09-30T23:59:59Z" \
  --data-urlencode "action=chat.completion" \
  --data-urlencode "limit=100" | jq '.events[] | {ts, actor, action, cost_usd}'

{
  "ts": "2026-09-08T09:14:22.481Z",
  "actor": { "type": "user", "id": "usr_01J7A...", "email": "alice@company.com" },
  "action": "chat.completion",
  "resource": "chat_01J9B...",
  "model": "claude-sonnet",
  "tokens": { "input": 812, "output": 340 },
  "cost_usd": 0.0153,
  "correlation_id": "cor_01J9B..."
}

Export for compliance

Export produces CSV or JSON of the current filtered view, signed with a checksum so a reviewer can prove it wasn't edited.

For a DSAR (Data Subject Access Request), use Compliance → Data subject request: enter the person's email, and the platform assembles a ZIP with their profile, conversations, agent runs, audit events, and cost records. Small workspaces finish in a minute or two; large ones are emailed a download link. The DSAR itself is an audit event — you can prove you responded, and when.

Retention

Audit records are append-only. Nobody, including Admins and including us, can edit or delete an individual event. Default retention is 7 years, which satisfies SOC 2 and typical financial-sector requirements. Chat and agent data has its own, separately configurable retention; deleting a conversation removes the content but leaves the audit record that it existed and was deleted.

Compliance dashboards

Compliance shows live status per framework — GDPR, LGPD, and SOC 2 — with the controls the platform covers (encryption, access control, retention, breach detection, subject rights) and the ones you own (who you granted Admin to, which connectors you enabled, your own retention choices). Each row links to the evidence in the audit trail.

Troubleshooting

"Events are missing." Check the timezone toggle — the table can show UTC or local, and it's easy to read across a boundary. Then check the date range and whether a stale filter is still applied (Clear filters). Events appear within a few seconds; a very recent action may simply not be indexed yet.

"My export is taking too long." Anything over ~100k events is queued and emailed. Narrow the date range or filter by action type. Exports run one at a time per workspace, so a large one already running will hold up yours.

"The compliance report is blank." It's scoped to the selected period; a brand-new workspace with no activity really does have nothing to report. Otherwise you're likely a Viewer on a different workspace — check the switcher.

Next: End-to-end workflow example