Skip to main content
Enterprise teams need to answer: who asked the agent to do what, using which systems, and what was produced? Hugo is Surfaice’s in-app AI agent — “agent runs” and “Hugo runs” mean the same thing. Surfaice maintains an audit trail of that activity for workspace administrators and compliance reviewers.

​
What is logged

Exact retention period and export format depend on your customer agreement. Request details in the NDA security package via security@surfaice.pro.

​
What is not a substitute for audit logs

  • PostHog / product analytics — funnel and usage metadata, not full message bodies
  • Chat UI scrollback — convenient for users, not the compliance system of record
  • Source systems — Lucernex and SharePoint retain their own access logs

​
Who can access audit data

  • Workspace administrators — operational review and support
  • Your IT / security team — via agreement-defined export or questionnaire process
  • Surfaice support — only when engaged for an incident, under contract
End users should not expect to browse every other user’s prompts unless your admin has granted that capability.

​
Using audit trails in practice

During rollout: sample 10–20 agent runs per week. Confirm connectors match approved scope and no unexpected mailbox reads occur. For Vanta / SOC 2: point reviewers to Security overview, Trust FAQ, and the NDA Application Architecture Diagram for logging boundaries.