Activity logs for Proton Pass for Business
If you have a Proton Pass Professional or Proton Business Suite administrator account, you can view your organization members’ activity logs. This provides visibility over all activity in your organization members’ Proton Pass accounts, such as any changes made to passwords and vaults. In short, activity logs will help you monitor who did what, when, and where (specifically, the IP address the activity originated from).
In this article, we’ll show you how to access your organization members’ activity logs and provide an overview of the events that are logged.
If your organization is on a Pass Essentials plan, you can upgrade to access this feature. To do this, click here and sign in using your Proton Pass for Business username and password.
How to access activity logs
To access your organization members’ activity logs:
1. Sign in to pass.proton.me(nouvelle fenêtre) using your Proton Pass for Business username and password and click Admin panel.
2. Go to Proton Pass → Activity log. Here, you can see the Time an event happened, the organization’s User account that it happened on, the type of Event (see below), and the IP address the activity originated from.
You can filter the logs by email or IP address, event type, and date range. You can also click on a time or event entry to filter by that timestamp or event type.
Click Download to export the logs as a comma-separated CSV file (with any active filters applied).
Activity log events
The following event types are logged.
Invites to your organization
These events relate to invitations to join your Proton Pass for Business organization.
| Event | Description |
|---|---|
| Invite Created | An invite to your organization has been created |
| Invite Accepted | An invite to your organization has been accepted |
| Invite Deleted | An invite has been deleted |
| Invite Rejected | An invite recipient has not accepted the invite |
New user invites
| Event | Description |
|---|---|
| New User Invite Created | A new user has been invited to your organization |
| New User Invite Deleted | A new user invite has been deleted |
Items
An item is any login or password, alias, card, or note stored in Pass.
| Event | Description |
|---|---|
| Item Created | A new item has been created |
| Item Updated | An item has been updated |
| Item Used | An item has been used |
| Item Read | An item has been read |
| Item Deleted | An item has been deleted |
| Item Trashed | An item has been sent to Trash |
Vaults
A vault in Proton Pass is an encrypted digital container that contains your items.
| Event | Description |
|---|---|
| Vault Created | A vault has been created |
| Vault Deleted | A vault has been deleted |
Email breach monitor
Your organization members can add custom email addresses that our Pass Monitor feature will scan the dark web for and alert you if they’re involved in any data breaches.
Learn how to use a custom domain with Proton Mail(nouvelle fenêtre)
| Event | Description |
|---|---|
| Breach Custom Email Created | A custom email has been added in Pass Monitor to be monitored |
| Breach Custom Email Validated | We’ve verified that this email address belongs to the organization member who added it |
| Breach Custom Email Deleted | An email has been removed from Pass Monitor |
Shared vaults
Vaults can be shared with anyone with a Proton Pass account. Learn how to share vaults using the Proton Pass:
- Browser extension(nouvelle fenêtre)
- Android app(nouvelle fenêtre)
- iPhone and iPad app(nouvelle fenêtre)
| Event | Description |
|---|---|
| Share Created | A vault has been shared |
| Share Deleted | A shared vault has been deleted |
| Share Updated | A shared vault has been updated |
Secure links
Secure link sharing allows you to share Proton Pass items (including individual logins, credit card details, and notes) with anyone, even if they don’t use Proton Pass.
Learn more about secure link sharing on the Proton Pass:
| Event | Description |
|---|---|
| Secure Link Created | A secure link has been created |
| Secure Link Deleted | A secure link has been deleted |
| Secure Link Read | A secure link has been read |