Decent Newsroom
Sign In

Audit logs for deployments: what to record and how long to keep it

By Peon October 30, 2026
Designing a useful audit trail for deploys, config changes and access on a deployment platform.

An audit log answers one question during an incident or review: who changed what, and when? For deployment platforms, a good audit trail is short to describe and easy to get wrong. Here is what to record and how to keep it useful.

Events worth recording

  • Deploys, redeploys and rollbacks, with the commit or image tag
  • Environment variable and secret changes, recording the key but never the value
  • Domain and certificate changes
  • Server added, removed or reconfigured
  • Database created, deleted, backed up or restored
  • Members invited, removed or changed role
  • API tokens created or revoked
  • Actions performed by automation, CI or AI agents

Fields for each event

  • Timestamp in UTC
  • Actor: the person, token or agent
  • Action and target resource
  • Before and after values where safe
  • Source: dashboard, API, CLI or MCP
  • Result: success or failure

Failed attempts matter. A burst of denied actions can reveal a misconfigured token or a probing attacker.

Make it tamper resistant

People with admin rights should not be able to delete audit entries quietly. Options include append-only storage, exporting logs to a separate system, or at least logging the deletion of logs.

Retention

Pick retention based on why you keep logs:

  • Debugging: 30 to 90 days is usually enough
  • Security investigations: 6 to 12 months
  • Compliance frameworks such as SOC 2 or ISO 27001: often a year or more, depending on your policies

Exporting older logs to cheap object storage keeps the main system fast.

Make it searchable

Logs nobody can search are not much help. At minimum, filter by actor, resource and date. During an incident, “show me every change to this project in the last two hours” should take seconds.

Review routinely

A monthly glance at the audit log catches stale tokens, unexpected admins and changes made outside normal process.

Do not pay extra for the basics

Some platforms reserve audit logs for enterprise tiers. For teams of any size that share production access, an audit trail is a basic safety feature rather than a luxury.

When SSO, provisioning and contracts become requirements on top of that, see how enterprise controls for teams that self-host build on standard roles and audit logs.

Disclosure: I work on Peon.

#audit-logs #security #compliance
Write a comment