Introduction
Audit logs give your security and IT teams a record of activity in your workspace: who signed in, who was added or removed, what was exported, what was published or shared, and when security settings changed.
🔷 Note: Audit logs are available on the Enterprise plan. They're enabled per workspace by the Gamma team, so talk to your customer success manager to turn them on.
What's captured
Every audit event records the who, what, and when of a security-or-compliance-relevant action in your workspace:
Who: the person who took the action, with their name and email. Actions taken by Gamma's own team or systems appear as Gamma Admin or Gamma System.
What: the action and its target - for example, the gamma (with its title), the member (with their email), or the connector involved, plus event-specific details like the old and new role, or the permission level on a shareable link.
When and where from: the timestamp, the actor's IP address, and their device.
How to enable audit logs
You don't need to do anything. Audit logs turn on automatically when your workspace is upgraded to Enterprise. Events are captured from the moment of the upgrade, and activity from before the upgrade is not backfilled.
Once audit logs are on, admins can view and export them in Gamma. You can also stream events to your SIEM or log platform.
Viewing and exporting audit logs
To view your workspace's audit log, go to Settings → Admin → Audit logs and click View. From there you can browse recent events and export them.
To monitor Gamma alongside your other tools, you can also stream events to your SIEM.
Streaming to your SIEM
Audit events can be streamed to your SIEM or log platform, including Splunk, Datadog, AWS S3, Google Cloud Storage, Microsoft Sentinel, and generic HTTPS endpoints, so your security team can monitor Gamma alongside the rest of your applications, set up their own alerting, and retain events on their own schedule.
Event catalog
The events below are captured today.
Sign-in and authentication
Event | What it records |
| Successful sign-in, with the auth method (password, Google, Apple, or SSO), IP address, and device |
| Sign-out, with what triggered it (e.g. manual logout, password reset, admin force sign-out, removal from the workspace) |
| Password changed, reset, or added |
| Account recovery attempted |
| Account email address changed, with the old and new values |
| A member's first or last name changed, by the member or synced from your identity provider through SSO, with the old and new values |
Members, guests, and roles
Event | What it records |
| Member invited, with the invitee's email |
| Pending invitation revoked |
| Member joined, with their role and how they joined (invite, join link, SSO provisioning, or admin-added) |
| Member's role changed, with the old and new role |
| Member removed, with their previous role |
| Guest granted access to the workspace, or a guest's access revoked |
| A member's Gamma account deleted |
Content, sharing, and data movement
Each of these carries the gamma it acted on, including its title.
Event | What it records |
| Gamma created |
| Gamma opened by a workspace member or guest. Logged once per viewing session, so reopening a gamma within 15 minutes doesn't log a new view. Anonymous viewers of public gammas aren't logged. |
| Gamma edited in the editor, by the Gamma agent, or through the API. Logged once per editing session: a new event is logged when someone edits again after 15 minutes without editing. |
| Gamma duplicated from an existing one |
| Gamma exported |
| Gamma archived, restored, or deleted |
| A person's access to a gamma granted, changed, or removed |
| Workspace-wide access to a gamma granted, changed, or removed, with the old and new permission |
| Shareable link created, changed, or removed, with the permission level and whether it's password-protected |
| Site published publicly or unpublished |
| Page published to a site |
Folder sharing
Each of these carries the folder it acted on.
Event | What it records |
| A person's access to a folder granted, changed, or removed, with the old and new permission |
| A group's access to a folder granted, changed, or removed, with the old and new permission |
| Workspace-wide access to a folder granted, changed, or removed, with the old and new permission |
Workspace and security configuration
Event | What it records |
| Admin workspace settings changed |
| SSO activated for the workspace |
| A member's sign-in switched to SSO, or their SSO access removed (including SCIM deprovisioning) |
| API key created or revoked, with the key's name |
| Connector (e.g. Google Drive, Slack, Notion) connected or disconnected, with the provider and account |
| An outside integration authorized to access the workspace |
| Audit logging itself turned on or off |
FAQs & Common Issues
Who can see our audit logs?
Only workspace admins will have access to the audit logs tab and the content there.
Can audit events include content that's private to a member?
Events can include metadata about private content. For example, a gamma export event includes the gamma's title even if it isn't shared with the workspace.
How long are events kept?
Events are retained for 30 days.
For longer retention, export events or stream them to your SIEM, where you control retention entirely on your side.
Does the log capture every action in Gamma?
No. Audit logs focus on security-relevant events: authentication, membership, data movement, and configuration changes.
More events will be added over time.