Activity & audit log

Evident keeps two separate logs, and the split is worth understanding because people look in the wrong one.

Activity

Activity in the sidebar. What happened in the product:

• Reviews approved, rejected, replied to
• Imports run, with their outcome
• Settings changed
• Loyalty adjustments and redemptions
• Widget and theme changes

This is the log for “why does this look different from yesterday” and “who approved that review”. It is scoped to the store environment.

Security audit

Security audit, a separate entry visible to owners and admins. Who did something security-relevant:

• Sign-ins
• Role changes
• Invitations sent and accepted
• API keys created, revoked, or used for the first time
• Connections added and removed

This is the log for “who has access” and “when did that key appear”. It is scoped to the organization, because that is the boundary access is granted at.

Reading them well

Look at what is absent. Both logs record actions, so the useful question is often what nobody did — an import with no rows processed, a key created and never used, a store that has had no activity since a staff change.

Adjustments deserve a reason. A loyalty adjustment records whatever note was typed. A month later, “goodwill” tells you nothing and “refund for damaged order #5581” tells you everything. Make your team write the second kind.

API key first use is the signal to watch. A key that was created six months ago and used for the first time yesterday is either a project finally shipping or something you should ask about.

Retention

Both logs retain for the life of the account. There is no rolling window that quietly drops the entry you need.

What is not logged

Be clear-eyed about the boundaries:

• Reads are not logged. The audit log records changes and access events, not every record someone looked at. If someone with legitimate access exported your review corpus, you will see the export; you will not see them paging through it in the UI.
• Storefront widget traffic is not in here. That is anonymous public traffic, not account activity.
• Platform-side changes are not in here. Something done in your BigCommerce or Shopify admin is logged by them, not by us.

Exporting

Both logs can be filtered and exported. If you are subject to an audit that wants evidence rather than a screenshot, export the range rather than transcribing it.