Audit Log — Thirteen of Our Fifteen Platforms Sell Permission, One Sells Memory

Quick answer: An audit log records who did what and when, in a form the actor cannot alter afterwards. Access control decides who is allowed to act; an audit log records that they did. Buyers routinely check the first and assume the second, and our corpus says the assumption is wrong. Searching our fifteen platform reviews for role-based access control or single sign-on matches thirteen files. Searching the same fifteen for an audit log or audit trail matches five. Of those five, two record an explicit absence, one records an inference the review itself marks "verify with sales", one appears only inside the alt text of a screenshot of a custom-priced Enterprise plan card, and exactly one — Botpress — carries a checkmark on a named tier sourced to a vendor pricing matrix. That tier is Team, at $939 a month monthly-billed. The same review is also the one that documents, in four separate passages, that Botpress keeps no version history over knowledge-base content. So the single platform in our corpus that logs who changed a setting is also the platform that tells you it cannot show you what the bot was reading when it answered.

What it actually is, and the three things it keeps getting confused with

An audit log is a per-action record. One row per event, each row naming an actor, an action, an object, a timestamp and usually an origin. Its value comes entirely from a property that has nothing to do with the data model: the people whose actions it records must not be able to change it. A log an administrator can edit is a report, not an audit log. That is why the feature reliably arrives bundled with role separation, and why it is priced the way it is.

Three neighbours get mistaken for it, and the confusion is expensive:

A transcript is not an audit log. Every platform in our corpus stores conversations. None of that tells you why a conversation went the way it did. If the bot quoted a wrong figure on 3 March, the transcript proves it said so; only a change record can tell you which version of which source it was reading at the time.

Analytics is not an audit log. A dashboard aggregates. An audit log itemises, and the itemising is the point — see chatbot analytics for the surface that answers volume questions rather than accountability ones.

Access control is not an audit log. This is the substitution that runs through our whole corpus. Role-based access control and single sign-on are prospective: they constrain what someone may do. An audit log is retrospective: it records what someone did. Buying the first and calling it the second is like fitting a lock and calling it a camera.

The counts, with the commands that produce them

Fifteen files match sample-reviews/*-review.md. Four searches, each executed from the repository root before this page was written, printed here in runnable form rather than inside a table so that the alternation pipes survive:

ls sample-reviews/*-review.md | wc -l
# 15

grep -rliE '\brbac\b|role-based access|single sign-on|\bsso\b' sample-reviews/*-review.md | wc -l
# 13

grep -rliE 'audit log|audit trail' sample-reviews/*-review.md | wc -l
# 5

grep -rliE 'version history|versioning|rollback|version control' sample-reviews/*-review.md | wc -l
# 5

Thirteen against five is the finding. The market has converged on selling permission and has not converged on selling memory.

Reading all five matches on the second search, here is what each one actually says. The distinctions matter more than the count, because four of the five are weaker than a checkmark:

The other ten reviews do not use either phrase. That is not evidence those platforms lack the feature; it is evidence that neither the vendor's public pages nor our reviewer surfaced it, which for a procurement question is a different problem with the same practical consequence.

What the log costs, which is the number nobody quotes

Only one row in that table has a price attached to it, and it is not a small one. Botpress Team is $939/month monthly-billed ($750/month if you pay annually, which is not the figure we use). Below it, Plus at $189/month monthly-billed carries a dash on the audit-log row. So on the only platform in our corpus that publishes the answer, the audit log sits behind a $750/month step — the difference between the two tiers, and very nearly four times what the entry paid tier costs in total. The step buys other things too: conversation volume, storage and unlimited seats all move at the same boundary, so $750 is what the log costs you, not what the vendor thinks a log is worth. You cannot buy it separately, which is the point.

Everywhere else the feature is bundled into a tier with no published number at all. Chatbase's Enterprise card lists audit logs alongside custom roles, single sign-on and white-labelling, and prices the bundle "Let's talk". Tars puts role-based access control and single sign-on on Enterprise, also custom-priced, and its Premium tier at $499/month gets ISO and SOC 2 attestations but no audit log our review found. Intercom's is "likely" on Expert at $132 per seat.

There is a pattern worth naming. The audit log is never sold on its own. It travels in a governance bundle with SSO, custom roles and sometimes data residency, and the bundle is what carries the price. That is commercially sensible and it produces a specific buyer failure: a small regulated team that needs exactly one of those four things has to buy all four, discovers the quote, and quietly decides the log is optional. It is worth knowing that this is the decision you are making, rather than making it by default at the point of sticker shock.

The half nobody sells: change history over what the bot reads

An audit log over the workspace answers who changed a setting. It does not answer what the bot was reading when it gave that answer, and for a chatbot the second question is usually the one that matters, because the answer came out of a knowledge source rather than out of a setting.

Our corpus is unusually clear here, and the clarity comes from a platform arguing against itself. The Botpress review — the one platform with a documented workspace audit log — states in four separate passages that knowledge-base content has no version history. Its own words: updating a source PDF overwrites the previous version "without diff visibility, change-log, or rollback path in the UI", which the review calls a "meaningful gap" for "teams that need an audit trail on knowledge-base content", and repeats in the scoring table and in the summary of frictions. Tars records the same gap explicitly, comparing itself to Botpress. Voiceflow is the one genuine counter-example and it arrives sideways: its Environments feature separates development, staging and production with per-environment knowledge bases and flows, and our review timed a rollback from production to the previous staging snapshot at 30 seconds. That is a promotion mechanism that happens to preserve a previous state. It is not a change log, it names no actor, and calling it versioning — as our own review does, hedged as "crude versioning" — is generous. SendPulse has a draft-versus-published distinction per chain, which is a workflow state and not a history.

The reconstruction window, and why it is usually zero

Here is the arithmetic, and as far as we know nobody states it this way, so treat it as ours rather than as an industry standard.

To answer "why did the bot say that, on that day", three records must be simultaneously alive at the moment somebody asks:

• T — how long the conversation transcript is kept
• C — how long the configuration change history is kept
• K — how long the knowledge-source version history is kept

The window in which the question is answerable is the intersection, not the sum:

A = min(T, C, K)

The consequence is unforgiving and it is why buyers get surprised. If any single term is zero, A is zero, no matter how generous the other two are. Retaining transcripts for thirty-six months buys you nothing on this question if K is zero, because you will be able to read exactly what the bot said and unable to establish what it was reading. On the published record of our fifteen reviews, K is documented as absent on two platforms, present in the weak environments-based form on one, and unrecorded on the other twelve. C is documented as present on a named tier on one.

Read that as a first question for a vendor call rather than as a score. The right form of the question is not "do you have audit logs" — every enterprise sales engineer says yes — but "on the tier I am buying, what is the oldest date for which you can tell me both who last changed my bot's instructions and which version of my documents it was searching?" The answer is a date or it is nothing.

How this connects to how long you keep things

An audit log has a retention period like any other record, and it is often shorter than the transcript retention people negotiate hard for. The two questions are separate and both belong in the same contract clause — see data retention policy for the duty side of that, and our banking chatbot guide for a worked case where a US federal record-retention rule runs materially longer than a documented platform retention period on the one platform in our corpus whose reviewed workflow was a banking one.

In US healthcare the demand for an audit log usually arrives through a contract rather than a feature list, which is the business associate agreement — and that entry records the same corpus shape from a different angle: exactly one of fifteen platforms names a BAA on a named tier in a vendor document.

Related terms

• Data retention policy — how long the log itself survives, which is the question immediately after "do you have one".
• Business associate agreement — the contract that turns an audit log from nice-to-have into a term.
• Chatbot analytics — the aggregate surface an audit log is routinely confused with.
• Session context — what the bot was holding in the moment, as distinct from what was logged about it.
• Unified inbox — where the human actions an audit log would record actually happen.
• Human handoff — the transfer event that most buyers assume is logged and should check.

FAQ

What is an audit log?

An append-only record of who did what, to which object, at what time. One row per action, naming an actor, an action, a target and a timestamp. The defining property is immutability by the people it observes: if an administrator can edit or delete entries about their own actions, it is a report rather than an audit log.

What is the difference between an audit log and an audit trail?

In vendor marketing, nothing consistent, and our corpus uses them interchangeably — the Botpress review says "audit logs" in its pricing table and "audit trail" in its cons and scoring sections about the same underlying gap. If you want a working distinction: a log is the raw stream of recorded events, and a trail is the reconstruction of one particular sequence out of that stream. You need the log to have a trail.

Do chatbot platforms have audit logs?

Some do; most of our fifteen reviews do not record one. Searching all fifteen for "audit log" or "audit trail" matches five files. Two of those five record an explicit absence, one records an inference the review marks for verification with sales, one appears only inside a screenshot of a custom-priced Enterprise plan card, and one — Botpress — carries a checkmark on named tiers in a vendor pricing matrix. Absence from a review is not proof of absence from the product, but it does mean the vendor's public pages did not answer the question.

What does an audit log cost on a chatbot platform?

On the only platform in our corpus that publishes the answer, it is the step from Botpress Plus at $189/month monthly-billed to Botpress Team at $939/month monthly-billed — a $750/month difference, though the step buys conversation volume, storage and unlimited seats as well as the log. Everywhere else the feature sits inside a custom-priced Enterprise bundle with single sign-on and custom roles, and no public figure exists.

Is an audit log the same as keeping chat transcripts?

No, and the difference is the most common expensive mistake here. Transcripts record the conversation. An audit log records the administrative actions around it: who changed the fallback message, who replaced a knowledge document, who exported contacts. Both can be required at once, they usually have different retention periods, and a contract that specifies only the first leaves the second at the vendor's default.

Does role-based access control give me an audit log?

No. Access control is prospective and constrains what a person may do; an audit log is retrospective and records what they did. They are commonly sold in the same bundle, which is exactly why the substitution happens. In our corpus thirteen of fifteen reviews discuss access control and five mention a log — if the two were the same feature, those numbers would match.

What should I ask a vendor?

One question, in this form: on the tier I am actually buying, what is the oldest date for which you can tell me both who last changed my bot's instructions and which version of my source documents it was searching? A date is an answer. "Enterprise-grade audit capabilities" is not.

Sources

• Chatbotscape review corpus, searched and read 29 August 2026. Denominator: ls sample-reviews/*-review.md | wc -l returns 15. The three greps printed in the body were executed verbatim from the repository root before publication and return 13, 5 and 5. Every quoted phrase below was read on the line it appears on.
• Audit-log evidence, per platform. sample-reviews/botpress-review.md (per-tier security matrix headed "verified on pricing page comparison matrix 26 May 2026", row "Audit logs (workspace change history)" with Free —, Plus —, Team ✅, Enterprise ✅; and the four knowledge-base versioning passages, including "without diff visibility, change-log, or rollback path in the UI"). sample-reviews/intercom-review.md (row "Audit logs", "⚠️ Not surfaced" / "⚠️" / "✅ Expert tier likely", source column "Verify with sales"). sample-reviews/chatbase-review.md (single occurrence, inside the alt attribute of the plan-selection modal screenshot, listing "Audit logs" on the Enterprise card alongside "Custom roles permissions SSO White-labeling"). sample-reviews/aisensy-review.md ("❌ Not advertised" on all three tiers, "No mention on vendor pages"). sample-reviews/landbot-review.md ("❌ Not advertised", "No mention on pricing or features pages").
• Prices, all monthly-billed and quoted from the review that recorded them: Botpress Plus $189/mo and Team $939/mo (sample-reviews/botpress-review.md, which also states the annual equivalents $150 and $750); Tars Premium $499/mo with ISO and SOC 2, Enterprise custom with RBAC, SSO and configurable retention (sample-reviews/tars-review.md); Intercom Expert $132/seat (sample-reviews/intercom-review.md); Chatbase Enterprise "Let's talk" (sample-reviews/chatbase-review.md).
• Version-history evidence: sample-reviews/voiceflow-review.md (Environments dev → staging → production, per-environment KB and flow versioning, measured 30-second rollback from production to the previous staging snapshot, and our own review's hedge "crude versioning"); sample-reviews/tars-review.md ("KB versioning not surfaced (similar to Botpress's no-versioning-UI gap)"); sample-reviews/sendpulse-review.md ("draft versioning per chain confirmed in the editor UI", a workflow state rather than a history); sample-reviews/chatfuel-review.md, whose single match on "rollback" refers to the vendor's own v7-to-v6 product rollback and is a false positive for this entry, disclosed rather than silently dropped.
• Method note, published against ourselves. A companion search on this run for Gramm-Leach-Bliley used the stem gramm and returned three files. All three were false positives on the word programmatic. The corrected search, grep -rliE 'gramm-leach|glba' sample-reviews/*-review.md, returns zero. The substring trap is the same failure class the 2026-08-29 entry recorded on "lever" and "workable", and it is the reason every count on this page is stated with the exact regex that produced it.
• A limit of the method, stated plainly. Ten of fifteen reviews do not use either phrase, and this page does not treat that as evidence the feature is missing. It is evidence that the question was not answered on a public page or in our review. For a procurement decision the practical consequence is the same; for a claim about a product it is not, and we do not make one.
• Botpress corpus defect, carried forward and not fixed in this run (reviews are on the hand-edited track): sample-reviews/botpress-review.md states its Plus tier price three incompatible ways — $189/mo in most passages, $89/mo in a pros card and two FAQ answers, and a "$150-189" range elsewhere. This entry uses $189/mo, which is the figure the pricing table and the annual-versus-monthly explainer both give. The Team figure of $939/mo is stable across the file. Previously flagged by the entries of 2026-08-26 and 2026-08-30; still open.
• Ahrefs Keywords Explorer, US overview and volume-by-country, queried 29 August 2026 — the demand, difficulty, CPC, global-volume, parent-topic and country-split figures in this entry's keyword note, including the checks behind declining 'audit trail' as a separate page and 'access control', 'role based access control', 'pci dss', 'two factor authentication', 'least privilege' and 'single sign-on' outright.
• Chatbotscape pricing methodology, including the monthly-billed rule applied to every figure above. /methodology (continuously updated).