Skip to main content
Some deployments matter for compliance. Some matter because the team needs to know who changed what and why. Either way, the audit trail is the record.

​
What’s audited

Nora records:
  • Every publish — who, when, from which Draft, release note, resulting version ID.
  • Every rollback — who, when, from → to versions, reason.
  • Every restore-Draft — who, when, which version was restored.
  • Every access change — permission grants and revokes.
  • Every secret rotation — who rotated which secret (value never logged).
  • Every approval decision — approver, timestamp, verdict, comment.
  • Every improvement deploy — improvement ID, cluster it addressed, target version.
Edits within Draft are not individually audited (auto-save churn would flood the log). The final Published version and its diff from the prior version are audited.

​
The audit view

Flow → Audit. Reverse-chronological list. Each entry:
  • Actor — name and email.
  • Action — publish / rollback / etc.
  • Target — Flow, version, block, secret.
  • Details — the specific change, release note, reason.
  • Source — UI / CLI / API / webhook.
  • IP / user agent — for the UI and CLI.
  • Signature — every audit entry is signed; tampering is detectable.
Filter by actor, action type, date range.

​
Workspace-level audit

For workspace-wide changes (member added, plan changed, connector rotated, etc.), a separate Workspace audit page collects them. Owners only.

​
Export

Every audit view is exportable:
  • CSV — flat table.
  • JSON — full detail per entry.
  • PDF — printable summary, one entry per row.
Exports are signed with a workspace-level signature so external auditors can verify authenticity.

​
Retention

Default: 1 year of audit history retained. Enterprise plans: configurable retention (up to 7 years or indefinite). Configure under Workspace settings → Audit retention. Older audit entries are archived (still queryable via export) but not shown in the default view.

​
Immutability

Audit entries cannot be deleted, edited, or reordered. If an entry is wrong, add a corrective entry — the original stays. This is what makes the audit trail trustworthy.

​
SIEM integration

For orgs with a security operations center, forward audit events to your SIEM:
  • Slack / Discord — webhook notifications on important events (publish, rollback, secret rotation).
  • PagerDuty — page on rollback or auto-rollback triggers.
  • Splunk / Datadog / SumoLogic — JSON stream via HTTPS.
  • Custom webhook — POST every audit event to your endpoint.
Configure under Workspace settings → Audit forwarding.

​
Compliance modes

For workloads under specific compliance regimes (SOC 2, HIPAA, GDPR), turn on Compliance mode:
  • Every action requires a reason (not optional).
  • Audit retention forced to the compliance-required duration.
  • Certain destructive actions require multi-sign approval.
  • Data export requires explicit approval workflow.
Compliance mode is per Flow. Turning it on is a one-way transition — turning off requires an Owner + written justification.