GitHub's organization audit log holds data for the last 180 days. The web view shows about three months by default, so older events need a created date filter. API access needs GitHub Enterprise Cloud. If your auditor wants a year of evidence, export or stream the log regularly.
Limits to know before an audit
| Item | What GitHub documents |
|---|---|
| Retention | Last 180 days |
| Default web view | Past three months |
| Export formats | JSON or CSV |
| Export caps | 100 MB compressed or 10 minutes processing |
| API access | Organizations on GitHub Enterprise Cloud |
| Who can open it | Organization owners |
The page does not give a separate retention figure for git events, so check your own plan if you rely on them.
Why this matters for evidence
Most audit periods are longer than 180 days. A SOC 2 observation window or an ISO 27001 surveillance cycle can cover many months. If your only record of who changed a branch rule is the live audit log, the oldest part of the period will have disappeared by the time the auditor asks.
The fix is dull and reliable: schedule an export, store it somewhere you control, and note the date range in the file name.
A monthly export routine
- Open the organization audit log as an owner.
- Filter with a created range, for example the last full month.
- Add action filters if the file is too large, such as repo, org or team events.
- Export as JSON, which keeps more structure than CSV.
- Save it to retention storage with read only access.
- Record the export in a simple log with date, range and who ran it.
Useful search qualifiers include action, actor, user, org, repo and created. Free text search is not supported, so know the action names you care about, such as team or repo events.
What to look at when reviewing
Look for changes to branch protection or rulesets, new outside collaborators, token and app activity, and members removed. Pair it with a reviewer sign off, because an export nobody reads is storage, not control.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the framework mapping demo and see how one piece of evidence, like an access log, maps to several control families.
Click through it at your own pace, or open it full screen.
Quick check
Can I get the audit log through the API on any plan?
The documentation says GraphQL and REST access to the audit log is for organizations on GitHub Enterprise Cloud.
Who can view the organization audit log?
Organization owners.
Sources
Last reviewed: 19 October 2026.
