diff --git a/docs.json b/docs.json
index e2ab4c22..c0e2f15a 100644
--- a/docs.json
+++ b/docs.json
@@ -106,6 +106,7 @@
                   "security",
                   "other-topics/using-secrets",
                   "other-topics/request-response-logging",
+                  "other-topics/audit-log",
                   "calculating-cost"
                 ]
               }
diff --git a/other-topics/audit-log.mdx b/other-topics/audit-log.mdx
new file mode 100644
index 00000000..da5a2224
--- /dev/null
+++ b/other-topics/audit-log.mdx
@@ -0,0 +1,87 @@
+---
+title: "Audit Log"
+description: Review who changed what in a Cerebrium project — app, secret, credential, member, and volume actions, with retention and API access by plan.
+---
+
+The audit log records actions taken against a project: who took the action, what it acted on, when, and whether it succeeded. Use it to answer who deleted an app, who read a secret, and who invited a member.
+
+Inference requests are not audited. They appear in [app logs](/other-topics/request-response-logging) instead.
+
+## Availability
+
+The audit log is included on the Standard and Enterprise plans. Retention sets how far back the log is readable:
+
+| Plan       | Retention    |
+| ---------- | ------------ |
+| Hobby      | Not included |
+| Standard   | 7 days       |
+| Enterprise | 30 days      |
+
+## Viewing the Log
+
+Open a project in the [dashboard](https://dashboard.cerebrium.ai/login) and select **Audit Log**. Select a row to expand the full detail of the entry.
+
+Filter by date range, action, or outcome. Only project owners can read the audit log.
+
+## Recorded Actions
+
+| Action                     | Records                                               |
+| -------------------------- | ----------------------------------------------------- |
+| `app.create`               | An app was created                                    |
+| `app.update`               | An app's configuration was changed                    |
+| `app.delete`               | An app was deleted                                    |
+| `build.download`           | An app's source was downloaded from a build           |
+| `build.cancel`             | A build was cancelled                                 |
+| `container.stop`           | A running container was stopped                       |
+| `run.cancel`               | An async run was cancelled                            |
+| `secrets.read`             | Secret values were retrieved, at project or app level |
+| `secrets.update`           | Secrets were changed, at project or app level         |
+| `apikey.create`            | An API key was created                                |
+| `apikey.read`              | API keys were listed                                  |
+| `apikey.delete`            | An API key was deleted                                |
+| `serviceaccount.create`    | A service account was created                         |
+| `serviceaccount.update`    | A service account was changed                         |
+| `serviceaccount.delete`    | A service account was deleted                         |
+| `serviceaccount.keys_list` | A service account's tokens were listed                |
+| `project.member_invite`    | A user was invited to the project                     |
+| `project.member_remove`    | A user was removed from the project                   |
+| `volume.file_download`     | A file was downloaded from a volume                   |
+| `volume.file_delete`       | A file was deleted from a volume                      |
+| `volume.resize`            | A volume was resized                                  |
+| `project.delete`           | The project was deleted                               |
+
+## Entry Contents
+
+Each entry records:
+
+- **Time** — when the action was taken
+- **Action** — the action name from the table above
+- **Actor** — the user or service account that took the action, with the email address, IP address, and user agent of the request
+- **Target** — what was acted on, as a type and ID, such as `app:my-app`
+- **Outcome** — `success` or `failure`, with the HTTP status code
+- **Details** — action-specific fields, such as the invited email address and role on `project.member_invite`, or the file path and region on `volume.file_delete`
+
+Failed attempts are recorded alongside successful ones.
+
+## Reading the Log Through the API
+
+The log is also available over the REST API, authenticated as a project owner:
+
+```bash
+curl -X GET "https://rest.cerebrium.ai/v2/projects/{project_id}/audit-log?limit=50" \
+  -H "Authorization: Bearer <JWT>"
+```
+
+Supported query parameters:
+
+| Parameter   | Description                                                          |
+| ----------- | -------------------------------------------------------------------- |
+| `from`      | Start of the window, RFC3339. Clamped to the plan's retention window |
+| `to`        | End of the window, RFC3339. Defaults to now                          |
+| `action`    | Return only this action, for example `secrets.read`                  |
+| `actor`     | Return only actions taken by this actor ID                           |
+| `outcome`   | Return only `success` or `failure`                                   |
+| `limit`     | Page size, 1–200. Defaults to 50                                     |
+| `nextToken` | Page token from the previous response                                |
+
+Entries are returned newest first. When `hasMore` is true, pass the response's `nextPageToken` as `nextToken` to fetch the next page.