Every action recorded
across the workspace

A workspace audit trail your auditor and your incident reviewer can both read

Security work generates a long tail of changes that matter only after the fact. Who changed that critical finding from open to accepted? Who uploaded the report? When did the engagement status flip from in progress to delivered? Programmes that lose this information either over-trust their team memory or reconstruct the timeline from chat history under audit pressure. SecPortal records every workspace action against a canonical activity log so the timeline is recoverable from a query rather than from memory.

The activity log is on by default for every workspace. Server-side code calls a single helper to record an event, the row lands in the activities table, and the dashboard, engagement detail, and client portal views read from the same source. Supabase row-level security keeps activities scoped to the tenant. The result is a single audit surface that findings management, team collaboration, and compliance tracking all share, rather than three separate timelines that only line up by hand.

Eight entity classes, one timeline

The activity log records actions across the entities that drive a security programme. Each row carries the actor, the action, the entity type, the entity identifier, a metadata payload describing the change, and a timestamp. The same shape covers a finding state change, an invoice payment, and a team-role update, so the timeline reads consistently across the work.

Filter the timeline to the question you are answering

The dashboard activity page exposes filter tabs that narrow the feed to a single entity class. When the question is about remediation throughput, the findings filter answers it. When the question is about evidence handover, the documents filter answers it. When the question is about access, the team filter answers it.

What auditors and incident reviewers ask the log

Auditors reading SOC 2 CC4.1 and CC7.1, ISO 27001 Annex A 8.15 (logging), or PCI DSS Requirement 10 read activity logs to evidence operating effectiveness rather than narrative claims. Incident reviewers read the same trail to reconstruct who took which action when, without trusting reconstruction from chat scrollback.

Properties that keep the trail defensible

Activity logs are only useful if they are durable, scoped, and attributed. SecPortal applies the same properties to every event, so the audit surface does not vary by feature area or by the team member who took the action.

Workspace, engagement, and client portal views

The same activity record is rendered through three different scopes depending on who is reading. A workspace member sees the cross-engagement feed at the dashboard level. An engagement lead opens an engagement and sees the activity attached to that engagement. A client portal user sees only the activity attached to their engagements, so the audit trail is transparent to the client without leaking across tenants.

Retention by plan

Activity retention is tied to the workspace plan. A daily cleanup job runs on Vercel Cron and removes activities older than the plan retention window, along with the notifications that fan out from those activities. Active workspaces stay inside the retention window without manual archiving; workspaces that need a longer window upgrade to the plan that matches the audit observation period.

Where the activity log fits in your audit and incident process

Activity logging is the connective tissue between operational security work and the evidence layer the audit cycle reads. It plugs directly into audit evidence half-life: an artefact captured at one point in time gets a half-life longer than its date stamp when the underlying activity log can reproduce the chain of state changes against the live record. It also lifts remediation tracking out of an interpretation question and into a query against the timeline. For the deeper view of how activity logs sit alongside scanning, reporting, compliance, and client delivery, see the security workflow orchestration research.

For frameworks that name a logging control directly, the activity log is the operating record: ISO 27001 Annex A 8.15 expects logging of user activities, exceptions, and security events; SOC 2 CC7.2 expects monitoring of system components and the operation of controls; and PCI DSS Requirement 10 expects logging of all access to system components. Workspace activity logging satisfies the platform-level expectation; system-of-record logs outside SecPortal still cover the rest of the estate.

Sensitive object lifecycles surface on the same timeline as the rest of the work. Credential creation and revocation events flow through the activity log alongside the objects they enable, so the audit trail for encrypted credential storage does not live in a separate vault log that has to be reconciled by hand.

Document custody questions resolve through the same feed. Every upload and delete on the engagement record writes a document.uploaded or document.deleted event with the file name and the actor identity, so the chain of custody for the engagement deliverable lives on the same timeline as the findings the deliverable describes. For the storage shape underneath, see document management.

The activity log is the historical record; the live signal layered on top is the per-user inbox. Each event that fans out into notifications and alerts is keyed to the originating activity row, so the bell points back to the same record the activity feed shows in retrospect. The audit surface and the live notifications surface share one source rather than two systems that diverge between reporting cycles.

The activity feed answers retrospective questions; the workspace global search palette answers prospective ones. An auditor reading back through a finding lifecycle opens the activity feed; an operator who already knows the finding name presses Cmd+K and lands on the engagement scoped to it. Both views read against the same workspace record, so the palette and the timeline never disagree about what happened or where it sits today.