Does Claude have audit logs?
By Dr. Leigh Coney, Founder of WorkWise Solutions · Updated October 20, 2026
Short answer: Yes, on Enterprise only, and they record events, not content. Owners can export 180 days of audit events such as sign-ins, file uploads and chat creation and deletion, but chat titles and content are excluded. For content, Enterprise has the Compliance API, which covers chats, files and Cowork sessions and can feed an archive such as Smarsh. Team and Enterprise can also stream Cowork activity through OpenTelemetry, which Anthropic says does not replace audit logging for compliance. Team has no audit log export and no Compliance API.
Claude has three logging tools, and RIAs mix them up. Each answers a different question.
- Audit log (Enterprise). Who signed in, who created or deleted a chat, who uploaded a file. Owners export it from Organization settings, Data and Privacy, 180 days at a time. In Anthropic's words, "Title and content of chats and projects are not available to be exported in audit logs."
- Compliance API (Enterprise). The content: chat data, files and activity events, covering Cowork in Claude, Claude Desktop and Claude Mobile, plus Claude Code. Only the Primary Owner can turn it on. It does not cover sessions on Amazon Bedrock or Google Vertex AI.
- OpenTelemetry (Team and Enterprise). A live stream of Cowork events, such as tool calls, file access and approval decisions, into your security tools. Prompt text is off by default. Anthropic is plain about its limits: "It doesn't replace audit logging for compliance purposes."
For an RIA, the Compliance API is the one that touches recordkeeping. Smarsh built Smarsh Capture for Claude Enterprise on it, so conversations, prompts and files can land in the same archive as your email.
One detail decides whether that archive is complete. For Cowork, Anthropic says the Compliance API returns sessions from the most recent 30 days. An archive that pulls once a quarter misses most of them. Set it to pull continuously, and test that it does.
Local Cowork sessions are covered as well. Enterprise admins can retrieve their content through the Compliance API, even though the history itself sits on the advisor's computer.
Team is the hard case: no audit log export and no Compliance API. You can still stream Cowork events through OpenTelemetry, which shows your security team what happened. For records, capture final outputs in your archive by procedure, and say plainly in your policy that this depends on people.
Supervision rides on top of all three. The SEC's fiscal 2026 exam priorities say staff will assess whether firms supervise their use of AI. Logs prove what happened. Your written procedures say who reviews them, how often, and what triggers an escalation.
I set it up for RIAs. Through WorkWise Solutions, the Claude for Financial Advisors setup covers the plan decision, the connectors, your firm's rules in the skills and archive capture, at a fixed price: $10,000 for firms of 1 to 10 people or $20,000 for 11 to 25, in two to four weeks.