Secryn records audit, request, user, and MCP logs for troubleshooting and review. Log rows are timestamped in UTC and visible only to admins. They are ordinary database records: they are not hash-chained, signed, or otherwise tamper-evident, and someone with database access can change or delete them.
Capture security-sensitive actions such as user sign-ins, resource creation, role changes, public URL updates, backups/restores, and setup wizard events. Each entry records the actor, action, target, timestamp, and source IP. Before and after values stored on an audit entry are encrypted with Laravel encryption keyed by APP_KEY.
Track API activity, including endpoint, method, status code, timestamp, auth context (user or access key), and execution duration. Sensitive payload data is never logged.
Show user-level events like authentication attempts, failed access, role changes, and actions performed within projects and vaults.
Document MCP server lifecycle events, client handshakes, tool/resource requests, authorization outcomes, and errors. MCP logs never include secret values or private keys.
APP_KEYUse these logs to review activity and troubleshoot automation. They are not a tamper-evident audit trail, and Secryn has not completed a third-party audit or penetration test.