Review your team's sign-ins and activity

The activity log shows workspace owners who on the team signed in, from where, and which sensitive actions they took. Use it for a regular access review, to look into a sign-in you do not recognise, or as the activity records in your written information security plan (WISP).

---

Where to find the activity log

Go to Settings, open General, and in the Security section choose View next to Activity log.

• Only the workspace Owner can open the activity log. Admins and standard users cannot see it.
• Viewing and downloading the activity log is part of the Pro plan. Tidyflow records activity on every plan, so after an upgrade the activity log already shows past entries. See pricing.

---

What the activity log records

Each entry shows the time, the team member, what happened, and for sign-ins the sign-in method, IP address and device (browser and operating system).

• Sign-ins: successful sign-ins, sign-outs, wrong passwords and wrong two-factor codes. The method shows whether the person used a password, a sign-in link, Google, Microsoft, Xero, an invite, a remembered device, the mobile app or the desktop app. Failed attempts are only recorded against real team accounts, not for email addresses that are not on your team.
• Account security: two-factor authentication turned on or off, password changed or reset, sign-in email changed, and API tokens created or revoked.
• Team changes: invites, role and permission changes, archiving and restoring team members, two-factor resets, and turning the workspace two-factor requirement on or off.
• Exports and downloads: client, contact, Job, invoice, time and report exports, bulk file and invoice downloads, the full file backup, and downloads of the activity log itself.

Client portal sign-ins are not part of the activity log. Changes to individual clients, Jobs and files keep their own history on those records.

---

Filter and download the activity log

The activity log opens on the last 30 days. Use the filters above the table to change the date range, show one team member (including actions that changed their account), or show one type of activity such as Sign-ins or Team changes.

To keep a copy, choose the download button next to the filters. It downloads the filtered entries as a CSV file, including the full browser details for each entry. The download itself is added to the activity log.

---

How long the activity log keeps entries

Tidyflow keeps activity log entries for one year, then removes them automatically. Download a CSV if your firm’s policy requires keeping records for longer.

Resetting your workspace does not clear the activity log. Deleting the workspace deletes it.

---

Checking a sign-in you do not recognise

If the activity log shows a sign-in from an IP address or device you do not expect:

1. Ask the team member whether it was them, for example on a new laptop, phone or network.
2. If it was not, have them change their password from their profile Security settings and turn on two-factor authentication. You can also archive the team member from Settings > Users to block access straight away.
3. Consider requiring two-factor authentication for everyone from the same Security section. See Signing in and account security.