Audit & Compliance
Automatic audit trails, permission controls, and workspace isolation for compliance-ready Flows.
Audit trail
When someone approves a budget, rejects a vendor, or sends a request back for changes, stepbase keeps a permanent, timestamped record of the decision. It happens automatically on every Flow. There's nothing to switch on.
For each action, the audit trail captures:
- Who did it: name and email
- What they did: approve, reject, submit, pick up the task, etc.
- When it happened
- Which step in the Flow they were on
- Any information they entered or changed
- Where the Flow went next
Administrators can view the full trail for any Flow run. Every entry has enough context to reconstruct exactly what happened and why.
Stage history
For each step in a Flow, you can see when it started, when it ended, who picked it up, what they decided, and what information they provided.
- When the step started and finished
- Who picked up the task (especially useful for team queues where any member can claim)
- What action moved it forward
- Every answer or document collected at that step
Taken together, this gives you a clean chain of custody: for any piece of data, you can show exactly who provided it, when, and as part of which decision.
Who can see and do what
You control access at three levels: workspace membership, what features someone can use, and who's assigned to each task.
| Level | What it controls |
|---|---|
| Workspace role | Owner, Admin, or Member. Controls access to workspace settings and admin features |
| App permission | User, Builder, or Admin. Controls which parts of the product someone can use (e.g. designing Flows vs. just running them) |
| Assignment | Only the people assigned to a task can see it or act on it |
Workspace isolation
Each workspace is completely separate. One team's flows, data, and audit records are never visible to another team.
- No workspace can see another's data
- A single user account can belong to multiple workspaces, but they always act inside one at a time
- All queries are tied to the workspace, so data can't leak across boundaries
- You join a workspace by invitation, so admins control who's in
Credential security
Any credentials you store (API keys, tokens, passwords for connected systems) are encrypted and never exposed in logs, exports, or API responses. The interface only ever shows masked placeholders.
Compliance use cases
stepbase's built-in audit and permission features make it well-suited for compliance-sensitive Flows.
- Financial approvals with threshold-based routing and decision records
- Regulatory submissions with full document trail
- Access requests with approval chains and audit logs
- Policy exceptions with justification capture and multi-level sign-off
- Vendor onboarding with compliance checks and risk scoring