Activity log
Review the append-only record of important practice changes, imports, exports and staff actions.
Open Settings → Activity log to see important changes across the practice. Each row keeps the action, affected record, acting staff member or system source, request identifier, field changes where available, and the time it happened. Display names are copied into the event so historical rows remain readable after the underlying record or user is removed.
The log is append-only: correcting an action creates another event rather than rewriting the old one. Imports, exports, organization and membership changes, and terminal background transfer outcomes use the same record.
Patient-linked audit detail follows the practice's audit-detail retention period: the action, time, actor and subject reference remain, while the patient-bearing label and field changes are removed. Staff-only and organization-only audit detail is outside that patient-retention clock.
Filtering
Click Filter to add a filter, or click a filter chip to change it. Every chip narrows the feed further, and Clear removes them all. The active filters are part of the page address, so you can bookmark a view or paste the link to a colleague and they open the same slice.
| Filter | What it matches |
|---|---|
| Member | Who acted — any of the people you pick. The list includes staff who have since left the practice, so their history stays reachable after their account is removed. |
| Source | Where the action came from: a staff member, a patient, an automation, a campaign, the AI, an API key, an import, or the system. |
| Action | Created, updated, removed, merged, exported, accessed or imported. |
| Record type | The kind of record affected, from the types that appear in your practice's log. |
| Record | Text contained in the affected record's name, such as part of a patient's name. |
| Support access | Whether the change was made during a Smileline support session. |
| Date | A preset such as Today, Last 7 days or This month, or a custom From and To range. Presets follow the practice's timezone. |
To see everything recorded about one patient, open their clinical record and choose More ▾ → Record history; see Record history.
Sign-in and security events
Signing in and out, a failed sign-in, a password or sign-in email change, a password reset request, turning two-factor authentication on or off, regenerating backup codes, signing other devices out, and creating or revoking an API key all appear in the log alongside record changes.
Repeated failed sign-ins for one account are grouped into a single row per hour, so a burst of attempts cannot flood the feed. A sign-in attempt for an address that does not belong to an account is not recorded at all.
Sign-in history
Click Sign-ins above the filters to show only sign-ins, failed sign-in attempts and sign-outs. Click it again to show everything.
To see one person's sign-ins, open Settings → Team, click Manage on their row and choose View sign-ins in the activity log under Sign-in history. The activity log opens filtered to that person and to sign-ins. Owners and managers, who can open the activity log, see the link.
Things to know:
- Sign-ins show from when the activity log started recording them.
- Someone who belongs to several practices may show a sign-in only in the practice they opened when they signed in.
- Repeated failed attempts appear as one row per hour.
- The log doesn't record where someone signed in from: no IP address and no device. Your own signed-in devices are under Settings → Account, in Active sessions.
- People who have left the practice keep their history: pick them under Member.
Actions taken by Smileline
When Smileline support acts on your practice — suspending or restoring an account, changing a platform role, deleting an account, or running a billing reconciliation — the event appears in your own activity log.
Smileline support works inside your practice only when you allow it, from Settings → Security. The log records each visit starting and ending, and every page support opens — before it's shown, then with its outcome. Every change made during a visit is authored Smileline support (as …) and carries the Smileline support marker. Messages, tasks and notes an automation produces from a step support last changed say so too. Choose the Support access filter to see every visit end to end. When Smileline operations open a stored inbound message to fix it, that's recorded here, with its reason, before it's shown. Changes made by an API key are marked API key, so automated traffic is never presented as a member working at the keyboard. Changes a patient or parent makes to their own patient portal sign-in — signing in, a lockout after too many wrong passwords, a new password, two-factor turned on or off, a device signed out — show the account holder's name marked Patient.
An hourly Stripe billing reconciliation that confirms stored billing state already matches Stripe does not create an activity row. It appears only when the audited billing state actually changes.
When an action creates, updates or deletes CRM data, Smileline saves the change and its audit row in the same database transaction. If the audit row cannot be saved, the CRM change is rolled back and the request fails; the system never reports an audited change as successful without its evidence.
Access-only actions, such as downloading an export or playing a call recording, do not change a CRM record. Smileline writes those audit rows directly and uses an idempotent recovery queue if the first insert cannot reach the database. Audit dead letters are re-queued instead of being discarded. Background jobs save important terminal state changes and their audit rows together as well.
Opening a patient whose record shows Call AI summaries, on Today or the patient record, is saved with the read itself, like opening a clinical record. If that audit row cannot be saved, the panel shows an error instead of the summaries; open the patient again to retry.
The in-app activity log supports operational accountability. It is not a replacement for a separately retained regulatory archive if your practice is required to operate one.