Every settings change and Company/Contact create/edit/delete, who did it, and when. Secret values (API keys, tokens) are never recorded — only that one changed.