# Account and users > Access options, managing users, account settings, API tokens and the audit log. ## Access options A user's access options decide what they can do in SaneLog. You set them under **Access options** when you add or edit a user under **Account > Users**. The options can be combined. A user with no options ticked is a normal user of the account. ### The options | Option | What the user can do | |---|---| | *(none)* | Use the whole product, reading and changing anything in it: sources, filters, alerts, the Log Explorer and their own settings. No account administration and no billing. | | **Account Admin** | Everything, including the **Account** section (users, settings, redaction, API tokens and the audit log) and **Billing**. Cannot be combined with the other options. | | **Billing Only** | Billing and nothing else: the plan, payment method and invoices. The product pages are not available, and **Plan** is the page they land on after logging in. | | **Read Only** | View everything they could otherwise see, without changing any of it. Their own [user settings](https://app.sanelog.com/docs/your-settings.md) (profile, password, two-factor authentication) stay editable. | ### Combinations - **Read Only** on its own gives a person who can view the product but not change it. - **Billing Only** and **Read Only** together give a person who can view billing but not change it - for example an accountant who needs the invoices. - **Account Admin** always stands alone. Ticking it clears and disables the other options. ### Locking someone out There is no "no access" option. To stop a user logging in, [deactivate them](https://app.sanelog.com/docs/account.md#deactivating). The user and their history are kept, and you can reactivate them at any time. ### Who manages users Only Account Admins can manage users. An account's first user is always an Account Admin, and can make other users Account Admins from the user's edit page. You cannot remove the **Account Admin** option from yourself, so an account always keeps at least one Account Admin. ## Managing users Account Admins manage users under **Account > Users**. Every user belongs to exactly one account and logs in with their email address. ### Adding a user Choose **Add user**, enter the person's email address, tick their [access options](https://app.sanelog.com/docs/account.md#access-options) and choose **Send invitation**. With no option ticked, they become a normal user with full product access. They receive an email with a link, choose their own name, password and timezone, agree to the [Terms of Service](https://app.sanelog.com/legal/terms) and the [Privacy Policy](https://app.sanelog.com/legal/privacy), and are then logged in. No user exists in the account until they accept. Until then the invitation is listed under **Pending invitations** at the top of the users list. An address that already belongs to a SaneLog user cannot be invited. Accepting an invitation also adds an [email notification channel](https://app.sanelog.com/docs/alerts.md#email) with the person's address, named after them, so any alert can send email to them. ### Pending invitations An invitation link is valid for seven days. Each pending invitation has three actions: - **Resend** sends a new email with a fresh link, valid for another seven days. The old link stops working. - **Copy link** shows the link so you can pass it on yourself, for example when the email is slow or caught by a spam filter. Anyone holding the link can join as that person, so every time the link is shown it is recorded in the audit log. - **Revoke** stops the link working immediately. You can invite the person again later. Only one invitation per address can be pending. To send another email, use **Resend** rather than inviting the address again. An invitation that expires disappears from the list. To give the person access, invite them again. ### A user's page Choose a user in the list to open their page. It shows four cards: - **Details** - name, email address, timezone and date format. A timezone or date format the user has not chosen shows as the account default. - **Access** - their access options, whether they are active, and whether a password change is required at their next login. - **Activity** - when they were created and when they last logged in. - **Notification channels** - the [notification channels](https://app.sanelog.com/docs/alerts.md#channels) that send to their email address or that they created, each linked to its page. Deactivating or deleting the user does not change these channels. **Edit** changes their name, email address, timezone, password, **Active** status and access options. Only the user can change their own date format, under **User settings > Profile**. Setting a new password for a user logs them out of every browser they are logged in from. ### Deactivating To stop a user logging in, open their edit page and switch off **Active**. They are logged out on their next click, and any coding agents they connected stop working. Notification channels that send to their address keep sending: check the **Notification channels** card on their page. An inactive user is kept, along with their history in the audit log. Switch **Active** back on to let them log in again. You cannot deactivate yourself. ### Deleting To delete a user, open their page and choose **Delete user** from the **More actions** menu (the **...** button). The user is removed from the account and cannot be restored from the app. The confirmation lists any notification channels connected to the user, which are not changed: manually edit or delete any that should stop. Their actions stay in the audit log, attributed to their email address with "(deleted)" after it. A deleted user's email address can be used again for a new user. To see deleted users in the list, switch on **Show deleted** in the list's filters. You cannot delete yourself. ### Two-factor authentication An Account Admin can require every user of the account to set up two-factor authentication, with **Require two-factor authentication** in [Account settings](https://app.sanelog.com/docs/account.md#account-settings). A user who has not set it up is taken to a setup page on their next click, and cannot use SaneLog until they finish. Without the requirement, each user decides for themselves under **User settings > Two-factor auth**. See [Two-factor authentication](https://app.sanelog.com/docs/your-settings.md#two-factor-authentication). An Account Admin cannot reset another user's two-factor authentication. A user who has lost both their authenticator app and their recovery codes should write to [support@sanelog.com](mailto:support@sanelog.com). ## Account settings Account Admins manage the account's settings under **Account > Settings**. The page shows the current settings, and **Edit** opens the form. The form has three cards: **Details**, **Security** and **Logs**, each described below. ### Details **Account name** - the name shown under each user's name in the top bar, and in invitation, alert and report emails. **Account contact email** - the address SaneLog writes to about the account itself. Invoices, payment notifications and emails about the free period ending, the card on file expiring and the account closing are sent to it. When the address changes, an email naming the new address and who changed it goes to the previous one. It starts as the address of the person who created the account. Other addresses can receive the invoices too: see [Email invoices](https://app.sanelog.com/docs/billing.md#email-invoices). **Default timezone** - the timezone every time in SaneLog is shown in, for users who have not chosen their own. [Scheduled alerts](https://app.sanelog.com/docs/alerts.md#alert-types) also run on this timezone. GMT applies until a timezone is set. **Default date format** - how dates are written, for users who have not chosen their own: **Day first**, **Month first** or **ISO 8601**. **Day first** applies until a format is set. Each user can choose their own timezone and date format under [User settings > Profile](https://app.sanelog.com/docs/your-settings.md#profile). ### Security **Require two-factor authentication** - every user of the account must set up two-factor authentication before they can use SaneLog. A user who has not set it up is taken to a setup page on their next click. The two session settings below are in the same **Security** card. ### Sessions **Session timeout (hours)** - how many hours a user can be inactive before they are logged out. A warning appears ten minutes before, with the option to stay logged in (see [Sessions](https://app.sanelog.com/docs/your-settings.md#sessions)). The maximum is 24 hours. Leave the field empty to use the default shown in it, which is normally no timeout. **End sessions when the browser closes** - on by default. Users must log in again each time they reopen their browser. Switch it off to keep users logged in between visits, for the period shown under the switch. That suits tablets and always-on dashboards. ### Logs **Accept unencrypted syslog** - off by default. When it is on, senders can use UDP or plain TCP on the account's syslog port as well as TLS. Anything sent unencrypted can be read on its way to SaneLog, so leave this off unless a sender cannot use TLS. See [Syslog](https://app.sanelog.com/docs/sending-logs.md#syslog). While it is on, the dashboard lists sources that sent unencrypted logs in the last day. **Approve new syslog sources automatically** - off by default. When it is on, every new hostname on the syslog port becomes an approved source as soon as it appears, without anyone approving it. When it is off, a new hostname from an address that is not trusted waits as a pending source until someone approves it. See [Approving senders](https://app.sanelog.com/docs/sending-logs.md#approving-senders). Switch this on only for servers whose hostnames and addresses change too often to approve by hand. For many servers behind one gateway, trusting the gateway's address works better. **Use AI features** - on by default. Features such as the Log Explorer's [plain-English search](https://app.sanelog.com/docs/log-explorer.md#asking-in-plain-english) and [Explain line](https://app.sanelog.com/docs/log-explorer.md#explain-line) send the information they need to the AI model provider listed on the [Subprocessors](https://app.sanelog.com/legal/subprocessors) page. Depending on the feature, that information can include log content. When it is off, those features are not offered to anyone in the account and nothing is sent to an AI model provider. The advanced search box still takes expressions. Redaction of personal data in incoming logs has its own page under **Account > Redaction**. See [Redaction](https://app.sanelog.com/docs/redaction.md). ### Deleting the account An Account Admin can delete the account with **Delete account** at the bottom of **Account > Settings**. The **Delete account** page lists everything that will happen, and you confirm by typing the account name. Deleting the account logs every user out, including you, and stops logs arriving at once. Any stored logs, sources, users and settings are deleted permanently 30 days later. Until then, the account can be restored with everything in place by writing to [support@sanelog.com](mailto:support@sanelog.com). An email saying so goes to the account contact email. - **A running subscription** has to be cancelled first, under **Billing > Plan**. Once the cancellation is scheduled, the account can be deleted straight away. No further charge is made, and the rest of the period already paid for is given up. - **A plan paid by invoice** is closed by writing to [support@sanelog.com](mailto:support@sanelog.com). ## API tokens An API token lets a script or coding agent read the account through the [API](https://app.sanelog.com/docs/api-reference.md#getting-a-token). Account Admins manage tokens under **Account > API tokens**. API tokens are separate from a source's token, which can only send logs. ### Creating a token Choose **Add token** and fill in: - **Name** - where the token will be used, such as "CI runner" or "Alex's laptop", so you know which one to revoke later. - **Expires** - **Never**, or in 30, 90 or 365 days. An expiry limits the damage if the token leaks, and you can always add another token. - **Allowed IP addresses** - optional. IP addresses or CIDR ranges, separated by commas. Requests from any other address are refused. Leave it empty to allow any address. A token can read the whole account: sources, filters, events within your plan's retention, alerts and incidents. It cannot change anything. A token belongs to the account, not to the person who created it. It keeps working if that person is deactivated or deleted. ### Seeing a token again A token's page shows its value whenever you need it. Choose **Show token**. There is no one-time display, and nothing you need to copy down straight away. Every time a token is shown, the audit log records who showed it. The page also shows when the token was last used, and the IP address and location it was used from. **Rotate** issues a new value for the token. The old value keeps working for an hour, so you have time to update every script or agent that uses it. ### Revoking **Revoke** on the token's page stops the token working immediately, including an old value still inside its hour after a rotation. Revoking cannot be undone. ### Where tokens go Give the token to the script or agent as an environment variable named `SANELOG_API_TOKEN`, the name the API reference uses. Send it as a bearer token on every request: ```bash curl -sH "Authorization: Bearer $SANELOG_API_TOKEN" https://app.sanelog.com/api/v1/me ``` `/api/v1/me` confirms that the token works and names the account it belongs to. ## Audit log The audit log shows who did what in the account, and when. Account Admins can read it under **Account > Audit log**. It records: - **Logins** - successful and failed logins, and how the person logged in (a two-factor code, a recovery code, a passkey or a trusted browser). Logins from a new browser, logouts, and browsers logged out or forgotten under **Devices** are recorded too. - **Security changes** - password changes and resets, two-factor authentication turned on or off, recovery codes regenerated or used, passkeys added or removed, and browsers trusted or no longer trusted. - **Users and invitations** - users created, edited, deleted or given different access options, and invitations sent, resent, revoked, shown with **Copy link** or accepted. - **Settings and records** - changes to the account settings, and sources, filters, alerts, channels, config sets, sender rules and API tokens created, edited or deleted. - **Sources and senders** - sources and senders approved or rejected, stored logs deleted, and source tokens rotated or revoked. - **Credentials and agents** - every time an API token or invitation link is shown, API tokens rotated or revoked, coding agents connected or removed, and Copy for agent used. - **Billing** - subscriptions started, changed, cancelled or resumed, and failed payments. Some entries have no person behind them. A source the syslog service registers by itself appears as a **System** entry, naming the address it sent from and whether the source was approved or left pending. ### What an entry holds Each entry shows when it happened, a description of what was done and to what, who did it (by email address), and the IP address they did it from with its location. Choose an entry to see its details, including what changed. Credentials are never written to the audit log. A webhook URL or a token appears as shown, rotated or revoked, never as its value. ### Finding things Narrow the list with the search box (which searches the descriptions) and the filters: - **Event** - one kind of event, such as a login or an edited filter. - **User** - one person's actions. - **From** and **To** - a date range. Dates are read in your timezone. ### What is not in it The audit log covers the account's settings and access, not the logs your servers send. Those are in the [Log Explorer](https://app.sanelog.com/docs/log-explorer.md#searching-and-narrowing). The audit log tells you who changed a filter, not what the filter matched.