DualEntry captures an immutable audit trail for every data change in the system. This trail provides the evidence your auditors need and underpins compliance with SOC 2, SOX, and other regulatory frameworks.
What the audit trail captures
Every user and system action that modifies data generates an audit event. Captured actions include:
- Record creation: when a bill, invoice, journal entry, or any other record is created
- Field updates: changes to any field on a record, with before and after values
- Status changes: transitions such as draft to posted, or open to closed
- Approval actions: every approval, rejection, and auto-approval from approval workflows
- Login events: successful and failed authentication attempts
- Role changes: when a user’s role or permissions are modified
- Period lock and unlock events: when an accounting period is locked or unlocked
- Bulk operations: mass updates, imports, and reclassifications, logged as a group with individual line-level detail
Each audit event records the timestamp, the actor who caused the change, the action type, before/after values for changed fields, and the affected record’s type and ID. An actor is a named user, an integration, an API key, the system itself, or the Accounting Intelligence agent. DualEntry records the agent as its own actor rather than as the person who triggered it. An action it takes on someone’s behalf displays as Agent on behalf of Jane Chen. A scheduled run with no triggering user displays as Agent alone. Login events additionally record the IP address and user agent of the session; other event types do not carry an IP address.
Audit trail retention
DualEntry retains audit trail data by default and does not purge or age it out on its own. This covers every event type the trail captures, including login history and period lock changes.
Retention is not a self-service setting. There is no screen in the application for changing this, so an organization that needs a different retention period, shorter or longer, should raise it with DualEntry directly.
Nothing in the trail is editable or removable from the application in the meantime. The practical consequence is that the audit trail is a record you read and export, never one you curate.
That immutability is the point of the control. An auditor asking whether entries could have been altered after the fact gets the same answer regardless of who they ask, because no role in the product can alter them.
Export what an engagement needs while the engagement is running, rather than assuming you can reconstruct a view of the trail later on request.
SOC 2 and SOX compliance
DualEntry’s audit trail satisfies the common criteria for change management and logical access controls under SOC 2 Type II. Your auditor can review activity by entry type and date range in the application, then export the results to CSV for workpapers. The trail demonstrates that all changes are attributable to an identified actor and that access controls are enforced consistently.
DualEntry undergoes an annual SOC 2 Type II examination. You can review our current attestation report, subprocessor list, and other security documentation on the DualEntry Trust Center. Contact your account team if you need a report or questionnaire that isn’t already published there. Accessing the audit trail
You access the audit trail from Configuration → Company → Audit Trail, which opens on the Logins tab. The page is read-only and divides activity across three tabs:
- Logins: every user sign-in attempt, successful or failed, with the IP address and user agent of the session
- Transactions: every create, update, delete, approval, rejection, and status change made to a record, with field-level before and after values
- Period Locking: every period lock and reopen, with the company, transaction category, and period affected
The Transactions tab gives you a keyword search, an Entry Type filter, and a date range. The Entry Type filter narrows the list to one record type and action combination, such as a created bill. Sort any tab oldest or newest first by clicking the Timestamp column header. The Logins and Period Locking tabs offer keyword search and sorting but no dropdown filters.
Export is available on the Transactions tab only. It downloads the entries currently filtered on screen as CSV for inclusion in auditor workpapers. The public API does not expose audit trail events today, so there is no direct programmatic feed from the audit trail into a SIEM. To notify external systems when business records change, use webhooks, which deliver signed events for records such as invoices, bills, and customers. Webhook topics do not include login or other security events. For security event review, use the in-app filters and the CSV export.
Company scope in the audit trail
The audit trail is scoped to your organization rather than to a single company, so one combined list covers activity across every company you have access to. If your organization runs several legal entities through multi-entity consolidation, events from all of them appear together in the same feed.
When an auditor asks for activity on one subsidiary, filter by entry type and date range, then identify the entity by opening the underlying records. Alternatively, export to CSV and reconcile the record numbers against that entity’s transaction list. Where you need activity already attributed to a company, the Period Locking tab is the exception: it reports the affected company for each lock and reopen event.
A user whose role confines them to specific companies sees only entries for those companies, plus organization-level events. Every other user sees all companies in the organization.
Audit trail records are append-only. Neither users nor administrators can modify or delete audit events, even with Admin-level permissions.
Last modified on September 14, 2026
