osFoundry / Platform
Security audit
Every login, every privileged action — searchable, exportable.
What it is
Security audit is the record of who did what in your osFoundry workspace. It captures every sign-in and every privileged action in one place, so there is always a clear answer to "who changed this, and when." Instead of piecing together activity after something looks wrong, you have a running trail you can search by person, action, or time range, and export when you need to hand it to someone else.
Because osFoundry is a bring-your-own-key desktop workspace, the events worth watching are specific: authentication (logins, sign-outs, failed attempts), key handling (adding, rotating, or removing the API keys that power your models), changes to workspace and security settings, member and role changes, and approvals of privileged actions your agents request before they run. Each entry is timestamped and attributed to a user, and the whole log is filterable — narrow to one member, one kind of action, or a window around an incident, then export the results as a file you can archive or feed into your own review process.
This matters more, not less, in an AI workspace, because agents can act on your behalf across chat, apps, code, and connected data. When work is delegated to automation, accountability has to be explicit rather than assumed. osFoundry is local-first, so your audit data can stay on your device rather than sitting on a vendor's servers, and there are no per-seat fees — auditing every member of a workspace costs nothing extra, so there is no incentive to leave activity untracked.
Key capabilities
- Records every login, sign-out, and failed authentication attempt with a timestamp and the user it belongs to
- Logs privileged actions: API key add/rotate/remove, workspace and security setting changes, and member or role changes
- Captures approvals of privileged agent actions, so automated work is attributable to the person who authorized it
- Search and filter the trail by user, action type, or time range to reconstruct exactly what happened around an event
- Export the log as a file you can archive for compliance or feed into your own review and monitoring tooling
Use cases
- Security lead: after a suspicious sign-in, filters the audit log to one account and a time window to see every action it took
- Workspace admin: reviews who rotated an API key and when, before deciding whether a leaked credential needs to be revoked
- Compliance owner: exports the login and privileged-action trail on a schedule to satisfy an access-review or audit requirement
Frequently asked questions
What does the osFoundry security audit log actually record?
Authentication events (logins, sign-outs, and failed attempts) and privileged actions — adding, rotating, or removing API keys, changing workspace and security settings, member and role changes, and approvals of privileged agent actions. Each entry is timestamped and tied to the user who performed it.
Can I export the audit trail?
Yes. The log is both searchable and exportable. Filter it down to the user, action, or time range you care about, then export the results as a file you can archive for compliance or load into your own monitoring and review tools.
Where is the audit data stored, and is it private?
osFoundry is a local-first desktop workspace, so your audit data can stay on your own device rather than on a third-party server. Combined with bring-your-own-key access, that keeps the record of who did what under your control instead of a vendor's.