Introduction
Audit logs give your security and IT teams a record of activity in your workspace: who signed in, who was added or removed, what was exported, what was published or shared, and when security settings changed.
🔷 Note: Audit logs are available on the Enterprise plan. They're enabled per workspace by the Gamma team, so talk to your customer success manager to turn them on.
What's captured
Every audit event records the who, what, and when of a security-or-compliance-relevant action in your workspace:
Who: the person who took the action, with their name and email. Actions taken by Gamma's own team or systems appear as Gamma Admin or Gamma System.
What: the action and its target - for example, the gamma (with its title), the member (with their email), or the connector involved, plus event-specific details like the old and new role, or the permission level on a shareable link.
When and where from: the timestamp, the actor's IP address, and their device.
How to enable audit logs
Audit logs are only available on enterprise plans. Ask your customer success manager to enable audit logs for your workspace. Events are captured from the moment audit logs are turned on, and activity from before enablement is not backfilled.
There's no in-product audit log viewer today. Your team receives events by streaming them to your own tools, where you can search, alert, and retain them on your own schedule.
Streaming to your SIEM
Audit events can be streamed to your SIEM or log platform, including Splunk, Datadog, AWS S3, Google Cloud Storage, Microsoft Sentinel, and generic HTTPS endpoints, so your security team can monitor Gamma alongside the rest of your applications, set up their own alerting, and retain events on their own schedule. Talk to your customer success manager to set up streaming.
Event catalog
The events below are captured today.
Sign-in and authentication
Event | What it records |
| Successful sign-in, with the auth method (password, Google, Apple, or SSO), IP address, and device |
| Sign-out, with what triggered it (e.g. manual logout, password reset, admin force sign-out, removal from the workspace) |
| Password changed, reset, or added |
| Account recovery attempted |
| Account email address changed, with the old and new values |
Members, guests, and roles
Event | What it records |
| Member invited, with the invitee's email |
| Pending invitation revoked |
| Member joined, with their role and how they joined (invite, join link, SSO provisioning, or admin-added) |
| Member's role changed, with the old and new role |
| Member removed, with their previous role |
| Guest granted access to the workspace, or a guest's access revoked |
| A member's Gamma account deleted |
Content, sharing, and data movement
Each of these carries the gamma it acted on, including its title.
Event | What it records |
| Gamma created, or duplicated from an existing one |
| Gamma exported |
| Gamma archived, restored, or deleted |
| A person's access to a gamma granted, changed, or removed |
| Workspace-wide access to a gamma granted, changed, or removed, with the old and new permission |
| Shareable link created, changed, or removed, with the permission level and whether it's password-protected |
| Site published publicly or unpublished |
| Page published to a site |
Workspace and security configuration
Event | What it records |
| Admin workspace settings changed |
| SSO activated for the workspace |
| A member's sign-in switched to SSO, or their SSO access removed (including SCIM deprovisioning) |
| API key created or revoked, with the key's name |
| Connector (e.g. Google Drive, Slack, Notion) connected or disconnected, with the provider and account |
| An outside integration authorized to access the workspace |
| Subscription changed or canceled |
| Audit logging itself turned on or off |
FAQs & Common Issues
Who can see our audit logs?
Admin users will have access to the audit tab and the content there. Enabling audit logs runs through your customer success manager. Setting up streaming is also available for Admin Users.
Can audit events include content that's private to a member?
Events can include metadata about private content. For example, a gamma export event includes the gamma's title even if it isn't shared with the workspace.
How long are events kept?
Events are retained for 30 days.
For longer retention, stream events to your SIEM, where you control retention entirely on your side.
Does the log capture every action in Gamma?
No. Audit logs focus on security-relevant events: authentication, membership, data movement, and configuration changes.
More events (like gamma views and edits, and granular permission changes) will be added over time.