Audit and evidence

Every security control needs evidence behind it. This article describes what WingGate's audit trail records, the boundaries it never crosses, and where to reconstruct who did what and when.

Audit boundaries

The audit trail is append-only and organization-scoped. These boundaries are fixed by contract, not by policy:

• Recorded: authentication successes and failures, authorization decisions (grants created, changed or revoked, and blocked operations), session lifecycle, and file/MCP operations, with the actor, result and time.
• Excluded by contract: secrets — no passwords, OTPs, private keys, passphrases, or full tokens in audit entries, logs, or error responses. Shell content and search patterns are not part of audit entries by design.
• No automatic retention, archiving or partitioning: the audit table grows with activity. Operators should monitor growth and introduce a retention strategy before storage pressure appears.

Where the evidence lives

Every session and grant change is recorded in the audit trail. Open your Organization's Audit view in the web console to reconstruct who did what and when. For reading audit records, investigating gaps, and fixing common audit issues, see Audit and troubleshooting.