Audit Trail & Monitoring
Freakout maintains a structured audit trail of security-relevant activity, giving enterprise customers evidence of who did what, and when.
What is recorded#
Every audit event captures the action taken, its outcome (success or failure), a severity level, a timestamp, the acting user, and the affected resource. Recorded activity includes:
- Authentication — sign-in, sign-out, new account creation, account linking, and failed authentication attempts.
- Administrative actions — role changes, user edits, approvals, rejections, and re-runs performed by platform administrators.
- Access changes — integration connections, API keys, and shop connections.
- Billing — subscription changes, credits, refunds, and cancellations.
- Data governance — data export requests, deletion and erasure requests, and retention actions.
- Automated jobs — privileged background operations, such as the scheduled purge of deleted assets.
What is never recorded#
Audit events are deliberately minimal. They reference IDs, not content:
- No request bodies, uploaded files, or prompts
- No passwords, tokens, secrets, or session cookies
- No payment card data or payment payloads
- IP addresses are stored only as one-way hashes, never in plain form
Retention#
Audit logs are retained for 365 days in write-protected log storage, separate from the product database. Retention is enforced by infrastructure lifecycle policy. Audit records are kept for the full retention window even if the associated account is deleted — this is a standard security-log exception under GDPR (see Compliance & GDPR).
Monitoring and alerting#
High-signal audit activity feeds automated monitoring:
- Spikes in authentication failures
- Privilege and role changes
- Data governance requests
- Billing overrides
- Audit pipeline failures
Alerts route to our operations team for triage. Infrastructure-level anomalies (network abuse, credential exposure, injection attempts) are monitored by a separate, dedicated alarm set.
Accessing audit evidence#
Audit queries run through a constrained, admin-only interface — every evidence query is itself audit-logged. If you need audit evidence for a security review or investigation, contact security@freakout.ai with the time range and scope, and we will provide an export.
In addition to the application audit trail, private asset storage read/write events are captured in separate storage-level access logs (see Security & Data Protection), giving two independent records for asset-access investigations.