Export the audit trail

Owners, admins and auditors can export the audit trail at any time. Exports are meant for reviews, incident response and auditors, and for your own SIEM.

From the dashboard

Open Evidence in your organization's workspace, choose the period and filters, and export as CSV or JSON.

Every export is listed in the export log with its date, author, filters, number of rows and the SHA-256 of the file. The dashboard checks the hash of the file it received against that log, so you can show an auditor that a file is the one zn produced.

Organization evidence puts the zn-gate audit trail and the cloud checks of your members' API keys in one file, as OpenTelemetry (OTLP JSON Lines), CSV or JSON, and goes into the same export log.

Exports identify people by an opaque member id (mem_…), never by email. Members shows which id belongs to whom.

OpenTelemetry (OTLP JSON Lines)

zn-gate can also write the trail as OpenTelemetry logs: one ExportLogsServiceRequest in OTLP/JSON per line, up to 500 records per line, one resource per install. On any machine, without an account:

zn log export --otlp --since 7d --out zn-audit-7d.otlp.jsonl

That is the format the otlpjsonfile receiver of the OpenTelemetry Collector reads, and each line can also be sent as is to any OTLP/HTTP POST /v1/logs endpoint. A minimal Collector (contrib) configuration:

receivers:
  otlpjsonfile: { include: ["./zn-audit-*.otlp.jsonl"], start_at: beginning }
exporters:
  debug: { verbosity: detailed }
service:
  pipelines:
    logs: { receivers: [otlpjsonfile], exporters: [debug] }

Swap debug for the exporter of your SIEM.

Each record is a zn.gate.decision event with OpenTelemetry semantic attributes where they fit (gen_ai.agent.name, gen_ai.tool.name, server.address, process.executable.name) and zn.* attributes for the rest: the decision and its reason, the secret's name and mode, and the audit chain (zn.audit.seq, zn.audit.prev, zn.audit.mac). A use under a Warn rule has the severity WARN. Never secret values.

The same records always produce the same bytes, so the same hash.

Retention

zn keeps audit records for 180 days and cloud evidence for 90 days. A SOC 2 Type II review usually looks at 12 months: export regularly (for example monthly) and keep the files with their hashes. See SOC 2 and AI coding agents.

Pushing the trail straight to your SIEM, longer retention, SSO and SCIM are not part of Team v0. Contact us if you need them.