# Export the audit trail

Export the organization's audit trail as CSV, JSON or OpenTelemetry logs, check its SHA-256, and read it with an OpenTelemetry Collector.

Source: https://usezn.com/docs/team/export/

Owners, admins and auditors can export the audit trail at any time. Exports are meant for reviews, incident response and auditors, and for your own SIEM.

## From the dashboard

Open **Evidence** in your organization's workspace, choose the period and filters, and export as **CSV** or **JSON**.

Every export is listed in the export log with its date, author, filters, number of rows and the **SHA-256** of the file. The dashboard checks the hash of the file it received against that log, so you can show an auditor that a file is the one zn produced.

**Organization evidence** puts the zn-gate audit trail and the cloud checks of your members' API keys in one file, as OpenTelemetry (OTLP JSON Lines), CSV or JSON, and goes into the same export log.

Exports identify people by an opaque member id (`mem_…`), never by email. **Members** shows which id belongs to whom.

## OpenTelemetry (OTLP JSON Lines)

zn-gate can also write the trail as OpenTelemetry **logs**: one `ExportLogsServiceRequest` in OTLP/JSON per line, up to 500 records per line, one resource per install. On any machine, without an account:

```bash
zn log export --otlp --since 7d --out zn-audit-7d.otlp.jsonl
```

That is the format the `otlpjsonfile` receiver of the OpenTelemetry Collector reads, and each line can also be sent as is to any OTLP/HTTP `POST /v1/logs` endpoint. A minimal Collector (contrib) configuration:

```yaml
receivers:
  otlpjsonfile: { include: ["./zn-audit-*.otlp.jsonl"], start_at: beginning }
exporters:
  debug: { verbosity: detailed }
service:
  pipelines:
    logs: { receivers: [otlpjsonfile], exporters: [debug] }
```

Swap `debug` for the exporter of your SIEM.

Each record is a `zn.gate.decision` event with OpenTelemetry semantic attributes where they fit (`gen_ai.agent.name`, `gen_ai.tool.name`, `server.address`, `process.executable.name`) and `zn.*` attributes for the rest: the decision and its reason, the secret's name and mode, and the audit chain (`zn.audit.seq`, `zn.audit.prev`, `zn.audit.mac`). A use under a Warn rule has the severity `WARN`. Never secret values.

The same records always produce the same bytes, so the same hash.

## Retention

zn keeps audit records for **180 days** and cloud evidence for **90 days**. A SOC 2 Type II review usually looks at 12 months: export regularly (for example monthly) and keep the files with their hashes. See [SOC 2 and AI coding agents](https://usezn.com/docs/team/soc2/).

Pushing the trail straight to your SIEM, longer retention, SSO and SCIM are not part of Team v0. [Contact us](https://usezn.com/contact/) if you need them.