Yes, with some planning. GitLab documents audit events that track actions such as permission changes and member additions or removals, and they are retained indefinitely. But group and project audit events need Premium or Ultimate, and API queries are limited to a 30 day span, so export in monthly slices.
What GitLab records
GitLab's documentation says audit events help you track who changed the permission level of a user for a project and when, and who added or removed a user and when. It suggests two evidence uses directly: generating a report for an external auditor requesting proof of logging, and providing a report of users with their group and project memberships for a quarterly access review.
What is available by tier
| Event level | Tier | Notes |
|---|---|---|
| Sign-in events | All tiers | Successful sign-ins appear in your profile's authentication log |
| Group audit events | Premium, Ultimate | Owner role needed to view all users |
| Project audit events | Premium, Ultimate | Maintainer role or higher to view all users |
The Auditor access level can see group and project events for all users. Check the exact roles in the current documentation before you assign them.
The 30 day window
For both group and project audit events, the created after and created before parameters are limited to a maximum difference of 30 days. In practice, a year of evidence means twelve calls. Script it by month and store each result under a dated name.
Known issues in the documentation include limited search: text search inside audit event details is not supported, and you can only filter by user and date range. Plan to filter in your own tools after export.
Steps
- Confirm your tier shows group and project audit events.
- Create a read-only service account or token owned by the person responsible for compliance.
- For each month, call the group and project audit events APIs with a window under 30 days.
- Save JSON by month and level.
- Record the run in your evidence log.
- Once a quarter, use the membership report for the access review and attach it to the signed review.
Time zones are covered in which time zone to use for evidence.
What the events do not prove
An event shows that something changed. It does not show whether the change followed policy. A new Maintainer added in May needs a request and approval record in your ticket tool.
Where Safeguard fits
Safeguard offers compliance and evidence automation, asset discovery and SBOM and dependency scanning, which add the scanning and inventory side to what your code host logs. Try the free scan.
Quick check
How long does GitLab keep audit events?
The documentation says audit events are retained indefinitely, with no retention timeframe.
Why export monthly if events are kept forever?
The API limits queries to 30 day windows, and an independent copy protects you if tier or access changes.
Sources
Last reviewed: 19 October 2026.
