Compliance 360 Activity Log Limitations: Coverage and Retention

Compliance 360 Activity Log limitations fall into three categories: customer-record coverage, excluded interactions, and a maximum retention period of twelve months. The log can support a review of access to customer personal information, but it is not a complete history of every interaction with that information.

TL;DR: Compliance 360 tracks specified customer-record activities, including supported printing and export operations. It does not track other record types or subsequent interactions with exported data. Download and export logs to an offline source if you need to retain them beyond twelve months.

Key takeaways

Tracking covers activities related to customer records, not all activity across NetSuite.
The default view shows the last month and can display up to 10,000 results. Neither limit defines retention.
Production and sandbox logs are independent and are not synchronized.
Activating the Activity Log prevents deletion of customer records and records dependent on them; attempted deletion produces a dependency error.

What does the Compliance 360 Activity Log cover?

The Activity Log shows who accessed customer personal information and what actions they took. Its scope is activities related to customer records, not every record or interaction across NetSuite. Personal information appearing elsewhere does not, by itself, bring that activity into scope.

NetSuite 2026.2 documentation confirms that the tracking and retention limitations documented in NetSuite 2026.1 continue to apply. Administrators should not assume broader coverage simply because they are reviewing the later release.

For an administrator, two questions should remain separate: what access a user was permitted to have, and what activity the log captures. A permissions review addresses the first; the Activity Log supports the second within its documented scope. Pairing this review with an employee-permissions audit using saved searches helps keep entitlement evidence distinct from evidence of actual activity.

A defensible audit statement is narrow: the review examined supported customer-data activities available in the selected account and date range. Avoid describing that as a review of all access to all personal information.

Which customer-data activities are tracked?

Supported channels extend beyond opening a customer entry form. They include saved searches, analytics workbooks and datasets, specified reports, and particular printing and export operations. These channels remain subject to the customer-record scope; their inclusion does not make the log general monitoring for every record those tools can access.

Channel	Supported activity
Entry forms	Creation, viewing, and editing of records
Saved searches	Utilization of saved searches
Analytics	Accessing analytics workbooks and datasets
Supported reports	Running the specific reports listed below
Record lists	Printing activities and exports, including Basic and Advanced Printing
CSV	Full CSV exports

Supported reports

The documented report list is specific:

Open Invoices
Open Sales Orders
Sales by Customer
Cases by Customer
AR Aging Detail
Unbilled Cost by Customer
Customer Profitability
Transaction Detail

Do not generalize this list into a claim that every report is tracked. When documenting a report-based investigation, name the report rather than writing only “report access reviewed.” That makes the evidence boundary visible to a reviewer who may not know which reports are supported.

For example, a review involving customer information accessed through Sales by Customer has a supported report channel to consider. A review involving a saved search has another supported channel. Neither establishes visibility into subsequent use of exported information.

Before requesting evidence, identify the channel involved. A request to “find all customer-data access” implies a completeness the Activity Log cannot provide.

Which interactions are not tracked?

The documented exclusions are important when interpreting an absent log entry.

Exclusion	Consequence for the evidence review
The NetSuite Service File Cabinet	Do not rely on this log to establish activity involving that channel.
The NetSuite Mobile Application	An absent entry does not establish that mobile activity did not occur.
External integrations and third-party applications	This log does not establish activity involving those integrations or applications.
Data exported from NetSuite services	Subsequent interactions with exported data are not logged.
Other record types	Activities from record types other than customer records are not monitored.

Tracked exports are not continuing file monitoring

Tracking an export operation is not the same as tracking access to the exported data afterward. Record-list exports and full CSV exports are supported operations, but subsequent interactions with their exported data fall outside coverage.

Consider a user who exports customer information and later opens or shares the resulting data outside NetSuite. Those are separate evidence questions. A tracked export may support the first question; it does not provide a continuing history of the exported data’s use. The absence of later events therefore does not establish that the data remained unused.

If the review also concerns who should have access, use a separate role and permission audit with saved searches to assess authorization. That complements the Activity Log without filling its activity-logging gaps.

How do display limits differ from retention limits?

Open Compliance 360 > Activity Log > View. The log presents data from the last month by default and can display up to 10,000 results. Use the Access Date Range filter for improved query performance.

These are retrieval considerations, not alternative retention periods. A default view showing one month does not mean only one month is retained. Likewise, the displayed results should not automatically be treated as the complete evidence for a broader investigation.

Recommended review checklist

The following is an administrative review approach, not a separate NetSuite workflow:

Confirm which account you are examining, particularly whether it is production or sandbox.
Navigate to Compliance 360 > Activity Log > View.
Set the Access Date Range to the period relevant to the review instead of relying on the default last month.
Use focused date ranges when examining large volumes, keeping the 10,000-result display limit in mind.
Record the account and date range alongside the evidence used in your review.

The documented information available for viewing and filtering includes:

Column	Information
Log Date	Date and time when the data was accessed, displayed in the time zone of the user viewing the log.
User	Name of the user who accessed the data.
User Role	Role of the user who accessed the data.

The viewing user’s time zone matters when comparing timestamps with other evidence. Record that context rather than assuming every reviewer sees the same clock time. The User Role field identifies the role associated with the access; a broader assessment of a person’s permissions remains a separate review.

How long does Compliance 360 retain Activity Log data?

Logs are stored for a maximum of twelve months. To retain them longer, download and export them to an offline source. Leaving evidence in the Activity Log is insufficient for a preservation requirement that exceeds that maximum.

Oracle provides the supplied retention reference in Purging of Activity Logs in Compliance 360.

An investigation may concern a supported activity but begin after the required evidence has passed the retention boundary. Coverage and availability are separate tests: the activity must be supported, and its evidence must still be available.

Recommended preservation checklist

For administrators and compliance teams, a practical preservation plan is to:

Identify the evidence-retention period required by the organization.
Compare it with the twelve-month maximum.
Establish a download-and-export schedule that preserves needed logs before they exceed that maximum.
Keep exported evidence in an offline source under the organization’s evidence-handling controls.
Check that preserved evidence covers the intended accounts and review periods.

These are planning recommendations, not documented export-interface instructions. Do not confuse exporting logs for preservation with tracking a customer-data export: one preserves evidence, while the other is an activity the log can capture through supported channels.

Account separation and deletion constraints

Activity Logs are tracked independently for different NetSuite account types. Sandbox activity does not affect production logs, and Activity Log data is not synchronized between production and sandbox accounts. A sandbox review therefore cannot substitute for a production evidence review.

Identify the account in which the activity occurred before collecting evidence. Similarly, do not assume that preserving one account’s logs preserves another account’s history. Testing a review approach in sandbox still produces evidence belonging to that sandbox account.

There is also a record-management consequence: while the Activity Log feature is activated, customer records and records dependent on them cannot be deleted. Attempted deletion prompts a NetSuite dependency error. Include this constraint in customer-record cleanup planning rather than treating every failed deletion as an unrelated permissions issue.

Access prevention remains a separate control concern. A review of account-access restrictions by role can support that discussion, but it does not expand Activity Log coverage or retention.

FAQ

Does Compliance 360 log access to exported data?

It tracks certain export operations, including record-list exports and full CSV exports. It does not log subsequent interactions with the exported data.

Does the default one-month view mean older logs are unavailable?

No. The default view and retention limit are different: the view initially shows the last month, while logs are stored for a maximum of twelve months. Use the Access Date Range filter for the period under review.

Are production and sandbox Activity Logs synchronized?

No. Logs are tracked independently by account type, and Activity Log data is not synchronized between production and sandbox.

Can customer records be deleted while the Activity Log is activated?

No. Customer records and records dependent on them cannot be deleted while the feature is activated. Attempted deletion produces a dependency error.