Collect evidence for an audit
Who this is for: admins, security leads and compliance teams who answer an auditor’s questions about your integrations.
Before you start: the audit log and the full export need the View audit log and Export company data permissions, which only admins have. Everyone can see workflows, their versions and their runs.
Liitora keeps a record of every change and every run. This page shows where to find the record for each question an auditor usually asks, and how to hand it over. Your compliance team decides what the records prove for your rules, such as DORA or NIS2.
Who changed a workflow, and who approved it
Section titled “Who changed a workflow, and who approved it”Every saved version is kept, with who made it and whether its tests passed.
- Open the workflow from Workflows.
- Select the Versions tab. Made by shows a person, an AI assistant or an API token for each version.
- To see what changed between two versions, pick them under Compare versions. You see the change in the YAML, in what the workflow can use, and in where the data goes.
The Overview tab lists under Approvals who approved which version and when. The full record is in the audit log:
- Open Settings, then Audit log.
- Type
workflow.approvedin What (contains).
Each entry shows When and Who approved, and under Show details the version number, whether an AI assistant or a person wrote it, and whether it uses AI. An approval by the only admin of their own version is recorded as workflow.self_approved_sole_approver, so it stands out. Turning the version on is a separate entry, workflow.activated.
If you need the approver to be someone other than whoever asked for the change, turn on Always require a second approver in Settings > Members. Changing that setting is recorded as approval_settings.updated. See Who may approve.
What a workflow can reach
Section titled “What a workflow can reach”Each version declares the connections and secrets it may use. Each connection lists the hosts it may call (its address and any Other hosts it may call), so a workflow can’t reach anything it didn’t declare.
- Open the workflow and its Overview tab.
- Connections it uses and Secrets it uses list them. Where your data goes shows where the version runs and where its logs and results go.
- For any one version, the approval page shows the same under What this workflow can use, step by step, as the approver saw it.
If a run tries to use something the workflow didn’t declare, Liitora stops that step, and the audit log records it as run.capability_denied.
Changes to connections and secrets are in the audit log too, for example connection.updated, secret.rotated and secret.revealed (an admin showed a secret value).
What a workflow did
Section titled “What a workflow did”- Open Runs, or the workflow’s Runs tab.
- Open a run. You see each step with its input, output and every web request, with secret values masked.
Run logs are kept for the time your plan sets. See Limits per plan. Run summaries, workflow versions, approvals and the audit log are kept while your company uses Liitora.
Where AI was used
Section titled “Where AI was used”A workflow with an AI step is marked Uses AI, and the approver must confirm the AI use before approving. The workflow.approved entry records that the confirmation was given. An admin can turn AI steps off for the whole company, which is recorded as ai_settings.updated. See AI in workflows.
Who has access
Section titled “Who has access”- Settings > Members lists the people and their roles. Invites, role changes and removals are in the audit log (
member.). - Settings > API tokens lists the tokens with what each one may do. Creating and revoking a token is recorded (
api_token.).
Hand the records over
Section titled “Hand the records over”To give an auditor a filtered list, use the audit log API. It filters by who, what and when:
GET /api/v1/audit-log?action=workflow.approved&from=2026-01-01&to=2026-06-30actor_kind picks people (user), AI assistants (agent), API tokens (api_token), our operators (operator) or Liitora itself (system).
For everything at once, download a full export. It holds the whole audit log, one entry per line, with your workflows, versions and runs. See Export or delete your data.
The audit log can’t be edited or deleted, not even by an admin. When our staff enter your company to help you, the visit and its written reason are in the log too.