The security log and your recent activity
See who signed in, who failed to, and every change to access in your organisation, and check your own recent account activity.
The security log answers one question: who got into my organisation, and what did they change? Admins read it at Admin → Security log. Every member can see their own slice under Password & 2FA.
What it records
Each row shows when it happened, what happened, who did it (and to whom), any detail, and the IP address and browser it came from.
| Filter | Events |
|---|---|
| Sign-ins | Signed in, failed sign-in, account locked after repeated failures, wrong second-factor code, account unlocked by an admin, signed out of other devices |
| Two-factor | Turned on or off, signed in with a backup code, new backup codes generated, reset by an admin |
| Passwords | Changed, reset link sent, set from a reset link, reset by an admin |
| API & webhooks | API key created or revoked, webhook endpoint added or removed, OAuth application created or revoked |
| Members | Invited, deactivated, reactivated, role changed, joined |
| Envelopes | Deleted (restorable for 30 days), restored, removed for good |
| Organisation | Deletion requested or cancelled, data export built or downloaded, settings changed, signer payment collection changed |
Failed sign-ins and lockouts are shown in red, and a sign-in with a backup code in amber, so they stand out.
Reading the page
- The tiles at the top count Sign-ins, Failed attempts, Lockouts and Access changes for the period you picked.
- Choose a category, a person, or a period (7, 30, 90 or 365 days). The page opens on the last 30 days and lists up to 500 of the most recent events.
- Press Download CSV to take the filtered list away. The columns are time (UTC), event, label, actor, target, detail, IP and user agent.
Rows are kept for a year and then removed automatically.
Your own recent activity
On Password & 2FA, the card Recent activity on your account lists your 15 most recent sign-ins, failed attempts and security changes from the last 30 days. If you see something you do not recognise, change your password and press Sign out everywhere else on the same page. See Passwords, two-factor and account security.
What it is not
The security log is about access to the organisation. It is separate from each envelope's hash-chained audit trail, which is the evidence of what happened to a document.
What to look for
- Repeated Failed sign-in rows for one person: a forgotten password, or someone guessing. Five wrong passwords lock the account for 15 minutes.
- Member role changed or API key created that you did not expect.
- Sign-ins from places or browsers that do not fit your team.