You can export your tenant's audit log at any time via the dashboard or the API. The export includes every row plus the hash chain metadata, so the auditor can verify integrity on their side without trusting Kommit.
From the dashboard
Compliance → Audit log → Export.
Pick a date range and a format (CSV, JSON, or NDJSON), then download. Exports up to ~500k rows complete in your browser; for larger ranges, Kommit emails you a signed download link when the export finishes (usually within a few minutes for ranges up to ~5M rows).
From the API
GET /api/v1/audit-log/export?from=2026-01-01&to=2026-03-31&format=ndjson
Authorization: Bearer <api-key>
The response is streamed NDJSON — one JSON object per row, in
hash-chain order. Each line contains the same fields visible in
the dashboard, plus prev_hash and row_hash so the auditor
can verify the chain offline.
What the export looks like
{"id":"...","actor":"alice@example.com","action":"policy.update",
"target":"policy:eu-ai-act-deployment","metadata":{...},
"created_at":"2026-03-12T09:14:22Z","prev_hash":"abc…","row_hash":"def…"}
What an auditor typically asks for
- —Full export of the audit log for the audit period (1–4 quarters most commonly).
- —Verification of the chain. They run the same SHA-256 walk Kommit's verify endpoint does, against the exported file. See [#hash-chained-audit-log] for the algorithm.
- —Population evidence. They sample N rows and ask you to produce the corresponding artifacts (the policy that changed, the agent run that was approved, etc.). Kommit's dashboard supports drilling from any audit row into the artifact it references; the article export contains direct links.
If your auditor needs a specific export format we don't support
yet, contact security@getkommit.ai and we'll work with you on
a one-off transformation for that engagement.
Retention reminder
Exports are static files. Once downloaded, retention is on you — Kommit doesn't store a copy of the export. Most customers archive exports to their own cold storage with the same retention as their accounting records (typically 7+ years).