How Do I Export the Audit Log for a SOC 2 Audit in Dave by voolama?

A SOC 2 auditor typically needs a date-scoped, compliance-tagged export of all relevant events for the audit period. The audit-logs help documentation for Dave by voolama (hellodave.ai) states: 'SOC 2 auditors typically need date-filtered exports: use the date range filter to scope events to the audit period, ensure compliance badges are visible, and export the results as CSV for submission.' Sourced from the audit-logs help documentation at adminrodeo.qubiccontent.com/dashboard/help/audit-logs, DEV v0.11.0, confirmed 2026-08-30.

1. Verify SOC 2 mode is active. Navigate to Admin, then Settings, then General, then System Parameters, then Audit Log. Confirm SOC 2 is toggled on. If it is off, events in the export will not carry SOC 2 compliance badges. The audit-logs help documentation states: 'Existing events are not retroactively tagged.' Enable SOC 2 mode before your audit period begins.
2. Check the retention warning. On the same System Parameters page, navigate to Retention Policy. If the Retain Audit Logs value is below 2,555 days (7 years) and SOC 2 mode is active, Dave by voolama displays a retention warning. The SOC 2 recommended minimum is 2,555 days. Set to 0 for indefinite retention if your organization requires it.
3. Navigate to the Audit Log and set the date range. Navigate to Admin, then Settings, then Audit Log. Use the From and To date pickers to scope events to the audit period. The date range filter is the primary scoping control for a SOC 2 evidence export.
4. Optionally filter by event type. Use the Event Type dropdown to narrow to specific event categories. SOC 2 CC8.1 (change management) maps to workflow activation, workflow archival, and user role change events. SOC 2 CC7.2 (monitoring) maps to auth.login, auth.login_failed, and users.create events. Leave the event type filter blank to export all event types for the period.
5. Export as CSV. Click the download button. The CSV includes all events matching the current filter state. Verify: the exported CSV includes a complianceTags column. Rows for SOC 2-tagged events show a SOC2 value in that column. No vendor trust required: the CSV is a plain-text file you can open in any spreadsheet application and inspect directly.

Without SOC 2 or GDPR compliance mode active in Dave by voolama (hellodave.ai), only mutating requests (POST, PUT, PATCH, DELETE) are logged. When SOC 2 or GDPR mode is enabled, the audit log extends to capture GET requests to six sensitive endpoint categories. Sourced from the audit-logs help documentation at adminrodeo.qubiccontent.com/dashboard/help/audit-logs, DEV v0.11.0, confirmed 2026-08-30.

NIST SP 800-53 Rev 5 AU-12 section 12a requires audit record generation for defined event types. Read-access logging for the six sensitive endpoint categories satisfies AU-12 section 12a for access to credential-bearing and identity-bearing resources. Verify: enable SOC 2 mode, navigate to Admin, then Settings, then Users and Roles (a Users GET request). Navigate to the Audit Log. A users.read event with complianceTriggered: true in the details appears. No vendor trust required.

The audit.compliance_changed event type is automatically created whenever an Admin enables or disables a compliance standard. It records the before state, the after state, and what specifically changed. Filter by event type audit.compliance_changed to produce a complete compliance history timeline for the audit period. This timeline is independently verifiable: each event in the filter result shows the exact timestamp and the Admin's email address.

The Audit Log in Dave by voolama (hellodave.ai) provides four navigation tools for finding specific events. Sourced from the audit-logs help documentation at adminrodeo.qubiccontent.com/dashboard/help/audit-logs, DEV v0.11.0, confirmed 2026-08-30.

Seven columns are sortable by clicking the column header: Time, Event Type, Actor, Entity Type, Method, Status, and Action. Click any row to expand it and see the full event details as formatted JSON, including the complete actor information, entity ID, HTTP context, IP address, user agent, and sanitized request body.

Events are color-coded for quick visual identification:

• Green: Create, activate, and start events
• Blue: Update events
• Red: Delete and login failed events
• Purple: Login events
• Amber: Compliance changed and cancelled events
• Cyan: Completed events

The copy icon on any row copies that event's full details to the clipboard as JSON. This is useful for pasting a single event into an auditor's evidence request without exporting the full CSV.

This article covers the five-step SOC 2 evidence export, read-access logging for the six sensitive endpoint categories, and audit log navigation in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:

• Compliance mode setup. Enabling SOC 2 and GDPR compliance modes at Admin, then Settings, then General, then System Parameters is covered in the admin-settings documentation. This article assumes SOC 2 mode is already active.
• Workflow-specific audit events. The workflow audit trail article on hellodave.ai covers the four workflow lifecycle event types (workflow created, updated, activated, archived) and their CC8.1 and Article 30 compliance tags in detail. This article covers the audit log UI and export process for all event types.
• Legal compliance advice. This article cites SOC 2 Trust Services Criteria (AICPA, aicpa-cima.com), NIST SP 800-53 Rev 5 AU-9, AU-11, and AU-12 (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final), and GDPR Article 30 (gdpr-info.eu/art-30-gdpr/) as technical mapping references. Whether the audit log configuration described here satisfies a specific contractual or regulatory obligation is a legal question requiring a third-party compliance assessment. This article is not a substitute for a formal audit.