[{"data":1,"prerenderedAt":876},["ShallowReactive",2],{"navigation":3,"\u002Fsecurity\u002Faudit-and-monitoring":395,"\u002Fsecurity\u002Faudit-and-monitoring-surround":871},[4,23,53,78,107,142,166,202,238,277,306,361],{"title":5,"path":6,"stem":7,"children":8,"icon":22},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Usage","\u002Fgetting-started\u002Fusage","1.getting-started\u002F3.usage","i-lucide-sliders",{"title":18,"path":19,"stem":20,"icon":21},"Signing in on the mobile app","\u002Fgetting-started\u002Fmobile-app-sign-in","1.getting-started\u002F4.mobile-app-sign-in","i-lucide-smartphone",false,{"title":24,"icon":22,"path":25,"stem":26,"children":27,"page":22},"Billing & Plans","\u002Fbilling","10.billing",[28,33,38,43,48],{"title":29,"path":30,"stem":31,"icon":32},"Plans","\u002Fbilling\u002Fplans","10.billing\u002F1.plans","i-lucide-credit-card",{"title":34,"path":35,"stem":36,"icon":37},"Limits & Usage","\u002Fbilling\u002Flimits-and-usage","10.billing\u002F2.limits-and-usage","i-lucide-gauge",{"title":39,"path":40,"stem":41,"icon":42},"Managing Your Subscription","\u002Fbilling\u002Fmanaging-your-subscription","10.billing\u002F3.managing-your-subscription","i-lucide-receipt",{"title":44,"path":45,"stem":46,"icon":47},"Add-ons","\u002Fbilling\u002Fadd-ons","10.billing\u002F4.add-ons","i-lucide-puzzle",{"title":49,"path":50,"stem":51,"icon":52},"Integrations","\u002Fbilling\u002Fintegrations","10.billing\u002F5.integrations","i-lucide-plug",{"title":54,"icon":22,"path":55,"stem":56,"children":57,"page":22},"Settings","\u002Fsettings","11.settings",[58,62,66,70,74],{"title":59,"path":60,"stem":61},"General","\u002Fsettings\u002Fgeneral","11.settings\u002F1.general",{"title":63,"path":64,"stem":65},"Leave Types","\u002Fsettings\u002Fleavetype","11.settings\u002F2.leaveType",{"title":67,"path":68,"stem":69},"Carry Forward","\u002Fsettings\u002Fcarryforward","11.settings\u002F3.carryForward",{"title":71,"path":72,"stem":73},"Department Management","\u002Fsettings\u002Fdepartments","11.settings\u002F4.departments",{"title":75,"path":76,"stem":77},"Public Holidays","\u002Fsettings\u002Fpublicholiday","11.settings\u002F5.publicholiday",{"title":79,"path":80,"stem":81,"children":82,"page":22},"Mcp","\u002Fmcp","12.mcp",[83,88,92,97,102],{"title":84,"path":85,"stem":86,"icon":87},"Overview","\u002Fmcp\u002Foverview","12.mcp\u002F1.overview","i-lucide-bot",{"title":89,"path":90,"stem":91,"icon":52},"Connecting","\u002Fmcp\u002Fconnecting","12.mcp\u002F2.connecting",{"title":93,"path":94,"stem":95,"icon":96},"Tools Reference","\u002Fmcp\u002Ftools","12.mcp\u002F3.tools","i-lucide-wrench",{"title":98,"path":99,"stem":100,"icon":101},"Security","\u002Fmcp\u002Fsecurity","12.mcp\u002F4.security","i-lucide-shield",{"title":103,"path":104,"stem":105,"icon":106},"Integrating Your Own MCP Client","\u002Fmcp\u002Fcustom-client","12.mcp\u002F5.custom-client","i-lucide-code",{"title":108,"icon":22,"path":109,"stem":110,"children":111,"page":22},"Leave Management","\u002Fleave-management","2.leave-management",[112,117,122,127,132,137],{"title":113,"path":114,"stem":115,"icon":116},"Leave Management Overview","\u002Fleave-management\u002Foverview","2.leave-management\u002F1.overview","i-lucide-palmtree",{"title":118,"path":119,"stem":120,"icon":121},"Requesting Leave","\u002Fleave-management\u002Frequesting-leave","2.leave-management\u002F2.requesting-leave","i-lucide-calendar-plus",{"title":123,"path":124,"stem":125,"icon":126},"Leave Balances","\u002Fleave-management\u002Fleave-balances","2.leave-management\u002F3.leave-balances","i-lucide-wallet",{"title":128,"path":129,"stem":130,"icon":131},"Group Booking","\u002Fleave-management\u002Fgroup-booking","2.leave-management\u002F4.group-booking","i-lucide-users",{"title":133,"path":134,"stem":135,"icon":136},"Editing and Cancelling Leave","\u002Fleave-management\u002Fediting-and-cancelling","2.leave-management\u002F5.editing-and-cancelling","i-lucide-pencil",{"title":138,"path":139,"stem":140,"icon":141},"Leave Troubleshooting","\u002Fleave-management\u002Ftroubleshooting","2.leave-management\u002F6.troubleshooting","i-lucide-life-buoy",{"title":143,"icon":22,"path":144,"stem":145,"children":146,"page":22},"Approvals","\u002Fapprovals","3.approvals",[147,152,157,161],{"title":148,"path":149,"stem":150,"icon":151},"Approvals Overview","\u002Fapprovals\u002Foverview","3.approvals\u002F1.overview","i-lucide-check-check",{"title":153,"path":154,"stem":155,"icon":156},"Leave Approvals","\u002Fapprovals\u002Fleave-approvals","3.approvals\u002F2.leave-approvals","i-lucide-calendar-check",{"title":158,"path":159,"stem":160,"icon":42},"Expense Approvals","\u002Fapprovals\u002Fexpense-approvals","3.approvals\u002F3.expense-approvals",{"title":162,"path":163,"stem":164,"icon":165},"Time Approvals","\u002Fapprovals\u002Ftime-approvals","3.approvals\u002F4.time-approvals","i-lucide-clock-9",{"title":167,"icon":22,"path":168,"stem":169,"children":170,"page":22},"Time tracking & monitoring","\u002Ftime-tracking","4.Time Tracking",[171,176,181,186,190,194,198],{"title":172,"path":173,"stem":174,"icon":175},"Clocking In & Location","\u002Ftime-tracking\u002Fclock-in-and-location","4.Time Tracking\u002F5.clock-in-and-location","i-lucide-map-pin",{"title":177,"path":178,"stem":179,"icon":180},"Overtime & Pay-Period Lockdown","\u002Ftime-tracking\u002Fovertime-and-lockdown","4.Time Tracking\u002F6.overtime-and-lockdown","i-lucide-lock",{"title":182,"path":183,"stem":184,"icon":185},"Geofencing","\u002Ftime-tracking\u002Fgeofencing","4.Time Tracking\u002F7.geofencing","i-lucide-map",{"title":187,"path":188,"stem":189},"Time & Projects","\u002Ftime-tracking\u002Ftimeandprojects","4.Time Tracking\u002FTime&Projects",{"title":191,"path":192,"stem":193},"Time Tracking","\u002Ftime-tracking\u002Ftime-tracking","4.Time Tracking\u002FTime-tracking",{"title":195,"path":196,"stem":197},"Timeboard","\u002Ftime-tracking\u002Ftimeboard","4.Time Tracking\u002FTimeBoard",{"title":199,"path":200,"stem":201},"Timesheets","\u002Ftime-tracking\u002Ftimesheets","4.Time Tracking\u002FTimesheets",{"title":203,"icon":22,"path":204,"stem":205,"children":206,"page":22},"Expenses","\u002Fexpenses","5.expenses",[207,211,215,219,223,228,233],{"title":208,"path":209,"stem":210},"Expense Claims","\u002Fexpenses\u002Foverview","5.expenses\u002F1.overview",{"title":212,"path":213,"stem":214},"Add & Manage Purchases","\u002Fexpenses\u002Fpurchases","5.expenses\u002F2.purchases",{"title":216,"path":217,"stem":218},"Travel & Mileage Entry","\u002Fexpenses\u002Ftravelentries","5.expenses\u002F3.travelentries",{"title":220,"path":221,"stem":222,"icon":32},"Company Card Expenses","\u002Fexpenses\u002Fcompany-cards","5.expenses\u002F4.company-cards",{"title":224,"path":225,"stem":226,"icon":227},"Per Diems","\u002Fexpenses\u002Fper-diems","5.expenses\u002F5.per-diems","i-lucide-utensils",{"title":229,"path":230,"stem":231,"icon":232},"Receipt Scanning","\u002Fexpenses\u002Freceipt-scanning","5.expenses\u002F6.receipt-scanning","i-lucide-scan-line",{"title":234,"path":235,"stem":236,"icon":237},"Statuses & Submission","\u002Fexpenses\u002Fstatuses-and-submission","5.expenses\u002F7.statuses-and-submission","i-lucide-git-pull-request-arrow",{"title":239,"icon":22,"path":240,"stem":241,"children":242,"page":22},"Documents & E-Signatures","\u002Fdocuments","6.documents",[243,247,252,257,262,267,272],{"title":84,"path":244,"stem":245,"icon":246},"\u002Fdocuments\u002Foverview","6.documents\u002F1.overview","i-lucide-folder-open",{"title":248,"path":249,"stem":250,"icon":251},"Uploading Documents","\u002Fdocuments\u002Fuploading","6.documents\u002F2.uploading","i-lucide-upload",{"title":253,"path":254,"stem":255,"icon":256},"E-Signatures","\u002Fdocuments\u002Fe-signatures","6.documents\u002F3.e-signatures","i-lucide-pen-tool",{"title":258,"path":259,"stem":260,"icon":261},"Audit Trail & Certificate","\u002Fdocuments\u002Faudit-trail","6.documents\u002F4.audit-trail","i-lucide-file-check",{"title":263,"path":264,"stem":265,"icon":266},"Templates & Bulk Send","\u002Fdocuments\u002Ftemplates-and-bulk-send","6.documents\u002F5.templates-and-bulk-send","i-lucide-layout-template",{"title":268,"path":269,"stem":270,"icon":271},"Onboarding","\u002Fdocuments\u002Fonboarding","6.documents\u002F6.onboarding","i-lucide-user-plus",{"title":273,"path":274,"stem":275,"icon":276},"Offboarding","\u002Fdocuments\u002Foffboarding","6.documents\u002F7.offboarding","i-lucide-user-minus",{"title":278,"icon":22,"path":279,"stem":280,"children":281,"page":22},"People & HR","\u002Fpeople","7.people",[282,286,291,296,301],{"title":283,"path":284,"stem":285,"icon":131},"Directory & Profiles","\u002Fpeople\u002Fdirectory-and-profiles","7.people\u002F1.directory-and-profiles",{"title":287,"path":288,"stem":289,"icon":290},"Managing Users","\u002Fpeople\u002Fmanaging-users","7.people\u002F2.managing-users","i-lucide-user-cog",{"title":292,"path":293,"stem":294,"icon":295},"HR Records","\u002Fpeople\u002Fhr-records","7.people\u002F3.hr-records","i-lucide-folder-archive",{"title":297,"path":298,"stem":299,"icon":300},"Performance","\u002Fpeople\u002Fperformance","7.people\u002F4.performance","i-lucide-target",{"title":302,"path":303,"stem":304,"icon":305},"Training","\u002Fpeople\u002Ftraining","7.people\u002F5.training","i-lucide-graduation-cap",{"title":307,"icon":22,"path":308,"stem":309,"children":310,"page":22},"Features","\u002Ffeatures","8.features",[311,315,319,324,329,333,337,341,345,349,353,357],{"title":312,"path":313,"stem":314},"Dashboard","\u002Ffeatures\u002Fdashboard","8.features\u002F1.dashboard",{"title":316,"path":317,"stem":318},"SMTP troubleshoot","\u002Ffeatures\u002Fsmtp-troubleshoot","8.features\u002F10.smtp-troubleshoot",{"title":320,"path":321,"stem":322,"icon":323},"Notifications","\u002Ffeatures\u002Fnotifications","8.features\u002F11.notifications","i-lucide-bell",{"title":325,"path":326,"stem":327,"icon":328},"Reports","\u002Ffeatures\u002Freports","8.features\u002F12.reports","i-lucide-bar-chart-3",{"title":330,"path":331,"stem":332},"Calendar & Leave Overview","\u002Ffeatures\u002Fcalendar","8.features\u002F2.calendar",{"title":334,"path":335,"stem":336},"Calendar Integration","\u002Ffeatures\u002Fcalendar-integration","8.features\u002F3.calendar-integration",{"title":338,"path":339,"stem":340},"Schedules","\u002Ffeatures\u002Fschedules","8.features\u002F4.schedules",{"title":342,"path":343,"stem":344},"Project Management","\u002Ffeatures\u002Fprojects","8.features\u002F5.projects",{"title":346,"path":347,"stem":348},"Expense Settings","\u002Ffeatures\u002Fexpense-settings","8.features\u002F6.expense-settings",{"title":350,"path":351,"stem":352},"Auth0 SSO Integration","\u002Ffeatures\u002Fauth0-integration","8.features\u002F7.auth0-integration",{"title":354,"path":355,"stem":356},"Password & Authentication Policy","\u002Ffeatures\u002Fpolicies","8.features\u002F8.policies",{"title":358,"path":359,"stem":360},"Email Configuration (SMTP)","\u002Ffeatures\u002Femail-configuration","8.features\u002F9.email-configuration",{"title":362,"icon":22,"path":363,"stem":364,"children":365,"page":22},"Security & Privacy","\u002Fsecurity","9.security",[366,371,376,380,385,390],{"title":367,"path":368,"stem":369,"icon":370},"Security Overview","\u002Fsecurity\u002Foverview","9.security\u002F1.overview","i-lucide-shield-check",{"title":372,"path":373,"stem":374,"icon":375},"Authentication","\u002Fsecurity\u002Fauthentication","9.security\u002F2.authentication","i-lucide-log-in",{"title":377,"path":378,"stem":379,"icon":21},"Two-Factor & Devices","\u002Fsecurity\u002Ftwo-factor-and-devices","9.security\u002F3.two-factor-and-devices",{"title":381,"path":382,"stem":383,"icon":384},"Audit & Monitoring","\u002Fsecurity\u002Faudit-and-monitoring","9.security\u002F4.audit-and-monitoring","i-lucide-scroll-text",{"title":386,"path":387,"stem":388,"icon":389},"Account Deletion & Privacy","\u002Fsecurity\u002Faccount-deletion-and-privacy","9.security\u002F5.account-deletion-and-privacy","i-lucide-user-x",{"title":391,"path":392,"stem":393,"icon":394},"Roles & Permissions","\u002Fsecurity\u002Froles-and-permissions","9.security\u002F6.roles-and-permissions","i-lucide-key-round",{"id":396,"title":381,"body":397,"description":864,"extension":865,"links":866,"meta":867,"navigation":868,"path":382,"seo":869,"stem":383,"__hash__":870},"docs\u002F9.security\u002F4.audit-and-monitoring.md",{"type":398,"value":399,"toc":850},"minimark",[400,404,417,422,425,509,528,533,539,572,582,586,597,601,608,668,677,681,696,709,713,716,765,782,786],[401,402,381],"h1",{"id":403},"audit-monitoring",[405,406,407,408,412,413,416],"p",{},"BookYourPTO keeps a detailed, tamper-evident trail of who did what, when, and from where. This is the system of record for compliance reviews, incident response, and answering \"who changed this?\" Most of this section is ",[409,410,411],"strong",{},"Executive-only"," — see ",[414,415,391],"a",{"href":392},".",[418,419,421],"h2",{"id":420},"audit-logs","Audit logs",[405,423,424],{},"Every meaningful action writes an audit entry. Each row captures:",[426,427,428,441],"table",{},[429,430,431],"thead",{},[432,433,434,438],"tr",{},[435,436,437],"th",{},"Field",[435,439,440],{},"Detail",[442,443,444,455,465,479,489,499],"tbody",{},[432,445,446,452],{},[447,448,449],"td",{},[409,450,451],{},"Action",[447,453,454],{},"Create, Update, Delete, Approve, Reject, Cancel, Sign, View, Download, Export, Login, Logout, Password change, Settings change, Submit, Mark paid, QuickBooks connect\u002Fdisconnect, Offboard, Reactivate, Data deletion.",[432,456,457,462],{},[447,458,459],{},[409,460,461],{},"Entity type & id",[447,463,464],{},"What was acted on (e.g. a leave request, a user).",[432,466,467,472],{},[447,468,469],{},[409,470,471],{},"Changes",[447,473,474,475,478],{},"A ",[409,476,477],{},"before\u002Fafter JSON"," snapshot of what changed.",[432,480,481,486],{},[447,482,483],{},[409,484,485],{},"Actor",[447,487,488],{},"The user who performed the action.",[432,490,491,496],{},[447,492,493],{},[409,494,495],{},"Organization",[447,497,498],{},"The org the action belongs to.",[432,500,501,506],{},[447,502,503],{},[409,504,505],{},"Context",[447,507,508],{},"IP address, user agent, and timestamp.",[510,511,514],"callout",{"color":512,"icon":513},"green","i-lucide-sparkles",[405,515,516,519,520,523,524,416],{},[409,517,518],{},"Available on every plan, including Free."," Audit logs used to be a Business-only feature — they're now included on ",[409,521,522],{},"all plans",". See ",[409,525,526],{},[414,527,29],{"href":30},[529,530,532],"h3",{"id":531},"where-to-find-them","Where to find them",[405,534,535,538],{},[409,536,537],{},"Settings → Security",", which has sub-tabs:",[540,541,542,549,555,561,566],"ul",{},[543,544,545,548],"li",{},[409,546,547],{},"Audit Logs"," — the full action trail above.",[543,550,551,554],{},[409,552,553],{},"Sign-in Logs"," — every login attempt (see below).",[543,556,557,560],{},[409,558,559],{},"Leave Transactions"," — balance and leave changes.",[543,562,563,565],{},[409,564,191],{}," — clock and entry changes.",[543,567,568,571],{},[409,569,570],{},"Security Violations"," — tripped guards and rejected attempts.",[405,573,574,575,578,579,416],{},"Access is ",[409,576,577],{},"Executive only"," — any other role receives a ",[409,580,581],{},"403",[529,583,585],{"id":584},"exporting","Exporting",[405,587,588,589,592,593,596],{},"Audit data exports to ",[409,590,591],{},"CSV or JSON",", up to ",[409,594,595],{},"10,000 rows"," per export.",[418,598,600],{"id":599},"sign-in-logs","Sign-in logs",[405,602,603,604,607],{},"Separately from audit logs, ",[409,605,606],{},"every login attempt"," — successful or failed — is recorded with:",[426,609,610,618],{},[429,611,612],{},[432,613,614,616],{},[435,615,437],{},[435,617,440],{},[442,619,620,628,636,644,652,660],{},[432,621,622,625],{},[447,623,624],{},"Email",[447,626,627],{},"The address used to attempt login.",[432,629,630,633],{},[447,631,632],{},"Success",[447,634,635],{},"Whether it succeeded.",[432,637,638,641],{},[447,639,640],{},"Reason",[447,642,643],{},"Why it failed, if it did.",[432,645,646,649],{},[447,647,648],{},"IP & user agent",[447,650,651],{},"The raw request origin.",[432,653,654,657],{},[447,655,656],{},"Device \u002F browser \u002F OS",[447,658,659],{},"Parsed from the user agent.",[432,661,662,665],{},[447,663,664],{},"City \u002F country",[447,666,667],{},"Approximate location from the IP.",[405,669,670,671,673,674,416],{},"Sign-in logs are viewable by ",[409,672,577],{},", at ",[409,675,676],{},"Settings → Security → Sign-in Logs",[418,678,680],{"id":679},"unknown-login-alerts","Unknown-login alerts",[405,682,683,684,687,688,691,692,695],{},"On a ",[409,685,686],{},"successful"," login from an IP ",[409,689,690],{},"not seen recently"," — and that isn't the account's very first login — an ",[409,693,694],{},"\"unknown login\" email alert"," is sent to the account owner. The email includes the time, IP, browser\u002FOS, and approximate location.",[510,697,699],{"color":698,"icon":101},"amber",[405,700,701,704,705,708],{},[409,702,703],{},"If you get an unknown-login email you don't recognize",", change your password immediately (this signs you out everywhere) and review your ",[414,706,707],{"href":378},"trusted devices",". Enable two-factor if you haven't.",[418,710,712],{"id":711},"retention","Retention",[405,714,715],{},"Logs are purged automatically after the organization's retention window.",[426,717,718,728],{},[429,719,720],{},[432,721,722,725],{},[435,723,724],{},"Log type",[435,726,727],{},"Default retention",[442,729,730,737,744,751,758],{},[432,731,732,734],{},[447,733,421],{},[447,735,736],{},"84 months (7 years) — configurable",[432,738,739,741],{},[447,740,600],{},[447,742,743],{},"Same window",[432,745,746,749],{},[447,747,748],{},"Token lifecycle logs",[447,750,743],{},[432,752,753,756],{},[447,754,755],{},"Notification logs",[447,757,743],{},[432,759,760,763],{},[447,761,762],{},"PHI logs",[447,764,743],{},[405,766,767,768,771,772,775,776,779,780,416],{},"When a user is ",[409,769,770],{},"GDPR-anonymized",", their audit rows are ",[409,773,774],{},"kept"," for reporting integrity, but the actor is shown as ",[409,777,778],{},"\"Deleted User\""," rather than their name. See ",[414,781,386],{"href":387},[418,783,785],{"id":784},"troubleshooting","Troubleshooting",[426,787,788,801],{},[429,789,790],{},[432,791,792,795,798],{},[435,793,794],{},"Error",[435,796,797],{},"Cause",[435,799,800],{},"Fix",[442,802,803,817,828,839],{},[432,804,805,811,814],{},[447,806,807,810],{},[808,809,581],"code",{}," opening Settings → Security",[447,812,813],{},"You aren't an Executive.",[447,815,816],{},"Audit and sign-in logs are Executive-only; ask an executive to pull what you need.",[432,818,819,822,825],{},[447,820,821],{},"Export looks truncated",[447,823,824],{},"Exports cap at 10,000 rows.",[447,826,827],{},"Narrow the date range or filters and export in batches.",[432,829,830,833,836],{},[447,831,832],{},"An old action isn't in the logs",[447,834,835],{},"It fell outside the retention window.",[447,837,838],{},"Older entries are auto-purged after the org's retention setting (default 7 years).",[432,840,841,844,847],{},[447,842,843],{},"Actor shows \"Deleted User\"",[447,845,846],{},"That user was GDPR-anonymized.",[447,848,849],{},"Expected — the audit row is preserved but the actor identity is removed.",{"title":851,"searchDepth":852,"depth":853,"links":854},"",1,2,[855,860,861,862,863],{"id":420,"depth":853,"text":421,"children":856},[857,859],{"id":531,"depth":858,"text":532},3,{"id":584,"depth":858,"text":585},{"id":599,"depth":853,"text":600},{"id":679,"depth":853,"text":680},{"id":711,"depth":853,"text":712},{"id":784,"depth":853,"text":785},"Audit logs, sign-in logs, unknown-login alerts, and log retention in BookYourPTO — what's recorded, who can see it, and how long it's kept.","md",null,{},{"icon":384},{"title":381,"description":864},"tBUAV8tFILp7N-ixS6ALKBxYzbxhd_WttZHmxvfcGnQ",[872,874],{"title":377,"path":378,"stem":379,"description":873,"icon":21,"children":-1},"Set up TOTP two-factor authentication, save backup codes, verify at login, and manage trusted devices in BookYourPTO.",{"title":386,"path":387,"stem":388,"description":875,"icon":389,"children":-1},"GDPR\u002FCCPA controls in BookYourPTO — delete your account or organization with an emailed code, export your data, opt out of third-party syncs, and understand anonymization.",1781157135107]