Compliance-ready audit logging built into every action
Structured events. Tamper-evident hash chain. S3 storage with SQL queries. Auto-attached SmooAI context — every event carries organization, user, agent, conversation, IP, and geo without manual instrumentation.
Three things general-purpose logs cannot do
DataDog and Better Stack are great products. They are not audit logs. Smoo Audit Logs is purpose-built.
Auto-context
Every SmooAI-emitted event carries organizationId, userId, agentId, conversationId, sessionId, IP, user-agent, and geo — without manual instrumentation. Your own events inherit the same context via one middleware.
Tamper-evident
Per-org, per-day SHA-256 hash chain. Each event links to the previous. A daily verifier publishes a root hash to S3 Object Lock — even SmooAI staff cannot rewrite history after the fact.
SQL-queryable
Events land in S3 as Parquet (Phase 1) / Apache Iceberg (Phase 2), queryable via Athena. Saved queries, scheduled exports, and a power-user SQL endpoint for compliance officers and incident responders.
One line to log an event
Server or browser. Same shape. Same context. No vendor SDK to learn.
import { createServerAuditClient } from '@smooai/audit-logs/server';
import { AUDIT_ACTIONS } from '@smooai/audit-logs/schema';
const audit = createServerAuditClient(
{
organizationId: org.id,
actorType: 'user',
actorId: user.id,
actorEmail: user.email,
},
{
endpoint: process.env.SMOOAI_AUDIT_INGEST_URL,
accessToken: serviceToken,
},
);
await audit.log({
action: AUDIT_ACTIONS.CRM_CONTACT_MERGED,
resource: { type: 'crm.contact', id: contact.id },
outcome: 'success',
diff: { before: { ...existing }, after: { ...merged } },
});Standard event catalog
Out-of-the-box dashboards and compliance reports pivot off these stable action names. Emit your own events alongside — everything in the catalog is auto-emitted by SmooAI services.
| Category | Action | Notes |
|---|---|---|
| Identity | user.signin | Includes failed signins |
| Identity | user.signout | — |
| Identity | user.password_changed | — |
| Identity | user.invited | — |
| Org | org.created | — |
| Org | org.member_added | — |
| Org | org.member_removed | — |
| Org | org.role_changed | Includes before/after roles |
| Org | org.subscription_changed | Stripe-driven |
| Org | org.product_purchased | Stripe-driven |
| Agent | agent.config_changed | — |
| Agent | agent.knowledge_doc_added | — |
| Agent | agent.knowledge_doc_removed | — |
| Agent | agent.escalation_created | — |
| Agent | agent.tool_failed | outcome=failure |
| CRM | crm.contact_created | — |
| CRM | crm.contact_merged | — |
| CRM | crm.contact_deleted | — |
| API | api.key_minted | Phase 1 shipped |
| API | api.key_rotated | Phase 1 shipped |
| API | api.key_revoked | Phase 1 shipped |
| Integrations | integration.connected | — |
| Integrations | integration.disconnected | — |
Built for compliance, security, and accountability
SOC 2 evidence
Every privilege change, every member add/remove, every API key event — captured with timestamp, actor, IP, and a tamper-evident hash. Auditor-ready exports in one click.
GDPR DSARs
Pull every action taken on a data subject in seconds. The schema is structured, not free-text, so subject-rights workflows are queries, not log greps.
Internal accountability
See which agent or which staff member touched a CRM contact, an agent config, or a billing subscription — with diff context for every change.
Security forensics
Replay a chain from an incident window. Hash mismatches surface tampering. Saved queries (Pro) alert on failed-signin bursts and impossible-travel patterns.
Customer disputes
When a customer says "I never deleted that" — pull the audit event with IP, user-agent, geo, and the cryptographic proof that the chain is intact.
BYOB Enterprise
Events written to your own S3 bucket. You own the data, the retention policy, and the cross-account IAM. SmooAI runs the ingest; your account stores the truth.
Simple pricing
Pay for events, not seats. Long-term retention costs cents per GB, not dollars.
Starter
- 1M events / mo
- 90 days hot (queryable)
- 365 days cold (Glacier)
- Basic dashboard
- Standard event catalog
Pro
- 10M events / mo
- 1 year hot retention
- 7 years cold (compliance)
- Athena SQL query API
- Saved queries + alerts
- CSV / JSON exports
Enterprise
- Unlimited events
- Custom retention
- BYOB — your own S3 bucket
- SOC 2 attestation cooperation
- Signed compliance reports
- Dedicated support
Start auditing in minutes
Drop the emitter into your app. SmooAI services emit the standard catalog automatically. Query it with SQL or browse the dashboard.