Audit log and data security

Overview

MetaLens360 is built to analyze Salesforce orgs without putting them at risk. This article explains the main safeguards and how workspace Admins review account activity in the Audit Log.

How your data is protected

• Read-only by design. MetaLens360 reads metadata from your orgs and repositories. It never deploys to Salesforce or writes to your Git repository.
• Workspace isolation. Every org, comparison, schedule and setting belongs to one workspace. Members see only their own workspace's orgs and data, and invitations can only add people to the inviter's own workspace.
• Encrypted credentials. Org access tokens and refresh tokens are encrypted at rest (AES-256-GCM). AI provider keys saved in Settings → AI Providers are also stored encrypted and are write-only: the app shows whether a key is set, never the key itself.
• Role-based access. What each person can change is controlled by their role. See Roles and permissions.
• Safe password resets. Reset links are single-use, expire in 30 minutes and never reveal whether an account exists. Changing a password signs out other sessions. See Sign in and reset your password.

Before you start

• Only workspace Admins can view the Audit Log. Others see "Admins only — you don't have permission to view the audit log."
• The log shows your workspace's activity only.

Steps

1. Open Settings and choose Audit Log (under Enterprise), or go to /settings?tab=audit.
2. Read the table. Each row has a Timestamp, the User, the Action and, for sign-in and password events, the IP address it came from.
3. Click Refresh to load the newest entries.
4. Page through older entries with the controls at the bottom of the table.

Actions you may see

Destructive actions (remove, revoke, deactivate) are highlighted in red; sign-ins in green; role changes in amber.

Example

During a quarterly access review, Priya (Admin) opens Audit Log and checks that the contractor deactivated last month hasn't signed in since. She sees a STATUS entry for the deactivation and no later LOGIN for that user. She also confirms every ROLE change to Admin was expected, then exports her notes for the review.

FAQs

Can I delete or edit audit entries?

No. The Audit Log is a read-only record.

Does the Audit Log record syncs and comparisons?

No — it focuses on account and access activity. For syncs, comparisons and repo fetches, use the Activity Timeline in Use the Diagnostics Console.

Are changes to the permission matrix recorded here?

Changes to a person's role are logged as ROLE. Edits to the matrix itself aren't listed. For changes to an email template, use History in the Communication Center.

Can MetaLens360 staff see my metadata?

Platform administrators can see cross-workspace usage counts (such as numbers of users and orgs) to run the service, but the platform overview never shows your workspace's metadata content. See Platform admin area.

Where should I never paste secrets?

Only enter credentials in the dedicated MetaLens360 fields (such as the connection dialog or AI provider key field). Never paste tokens, SFDX Auth URLs or passwords into support messages or the AI assistant — treat them like passwords.

Troubleshooting

"No audit activity yet"

Nothing has been recorded for your workspace yet. If you expected entries (for example, after inviting someone), click Refresh. If the log stays empty, contact support so they can check that activity is being attributed to your workspace.

I see a LOGIN from an IP address I don't recognize

Ask the user to reset their password straight away, which also signs out other sessions. If the account shouldn't be in use, Deactivate it in Settings → Users and contact support.

Related articles

• Roles and permissions
• Invite your team
• Sign in and reset your password
• Workspace settings