A history that cannot be rewritten.
Every step of every case is recorded, attributed and protected. Critical operations succeed only if the audit succeeds.
Also included in Free. Legal hold is part of the Enterprise plan.
- For
- Compliance
- IT
The problem
In an audit the question is always the same: who did what, when and with what authority? With editable application logs, overwritten "last modified" fields and actions by automations or AI agents attributed to a generic "system", the answer is partial. And a log that can be rewritten is not proof. Whoever must answer an auditor, a client or an authority cannot settle for a plausible reconstruction: they need a history nobody, not even an administrator, can correct after the fact, and attribution precise enough to tell a person, a rule, a timeout or an AI assistant apart.
Timeline
- Person · approved
- Gear · automatic rule
- Clock · timeout
- Key · API
- Robot · Laura via AI assistant
Activity log
- Filters: actor · action · object · channel · period
- [Export CSV]
How it works
1Write-once history
Case history is protected at database level: application edits and deletions are rejected. The only exceptions (retention, erasure, demo resets) are explicit and traced.
2Atomic audit
Critical operations (retention, legal hold, deletion of cases and organizations, task corrections, access) succeed only if the audit is written in the same transaction; otherwise they are rolled back.
3Precise attribution
Every row says who acted: person, automatic rule, timeout, event, API key, "person via AI assistant", "FlowSharp Support".
4Searchable activity log
Filters by actor, action, object, channel (interface, MCP agent, engine, platform) and period, with export.
Specifications
| Case history | write-once, protected by database triggers |
|---|---|
| Atomic audit | rollback if the trace is not saved |
| Flow lifecycle | publication, fork, import, deletion with the design revision |
| Activity log | CSV/JSON export up to 50,000 rows, traced |
| Retention | audit from 30 to 3,650 days (365 preset); cases per flow |
| Access | logins, failed attempts and two-step verification recorded |
| Legal hold | blocks retention and deletions (Enterprise plan) |
An operational example: one case, five authors
In a case the timeline shows every step with a symbol saying who acted: a person approved, a gear indicates an automatic rule, a clock a timeout, a key an API call and a robot Laura's action through an AI assistant. Whoever reads does not have to guess whether a step was human or automatic. Alongside, the activity log lets you search by actor, action, object, channel and period, and export the result as CSV or JSON, up to 50,000 rows and with the export itself traced. Under the surface, case history is protected at database level: application edits and deletions are rejected, and critical operations succeed only if the audit is written in the same transaction. The diagram beside it is illustrative and not an official screenshot. The audit trail is also included in Free.
How to answer an auditor with evidence
When an auditor asks who did what, start from the case timeline and then widen with the activity log, filtering by actor, channel or period. Attribution distinguishes person, rule, timeout, event, API key, person via AI assistant and FlowSharp Support. For corrections to completed tasks, the history keeps the values before and after. For retention, the audit is kept from 30 to 3,650 days, with 365 preset, separately from case retention, and legal hold, part of the Enterprise plan, blocks retention and deletions. Credentials never appear in the log: no passwords, verification codes or tokens, and names are masked where needed. Logins, failed attempts and two-step verification are also recorded. The service helps support traceability and oversight requests, but compliance remains a journey for the organization.
Related features
- Case detail and "who did what" timelineEvery history line says who or what acted, down to the person behind an AI assistant.
- Activity logWho, when, through which channel and on what, including logins, failed attempts and two-step verification.
- Legal holdBlocks retention, deletion and purge of documents of cases or flow versions, with a mandatory reason.
- Configurable retentionDistinct retention for completed cases, audit, AI call log and webhook receipts.
- Agent attributionHistory shows the AI client and the person holding the key; the cost goes to the key.
- Transparent support impersonationSupport actions appear as "FlowSharp Support", with duration limits.
Use cases
Frequently asked questions
Can an administrator edit the history?
Not from the application: edits and deletions are rejected at database level, except for the explicit, traced exceptions.
Are AI agent actions recognizable?
Yes: the history shows the AI client and the person who owns the key.
How long is the audit kept?
From 30 to 3,650 days, configurable per organization and separate from case retention.
Does it help with ISO and the AI Act?
It is designed to support traceability and oversight requests: compliance remains a journey for the organization.