The audit question low-code cannot answer
An auditor's questions are duller than people expect. Who changed this record. At what time. From which account, and from what IP. Nothing about architecture, nothing about your roadmap. On a low-code platform the honest answer is usually some version of "I can find that out, for a while, if we pay for the right plan." That sentence is fine until the day it is not.
Who is allowed to see the log
Airtable publishes audit logs, and they are good ones. Each event carries a timestamp, the action, the affected object, the user's email, the IP address and the user agent. The catch is where that feature sits. Audit logs and DLP appear only on Enterprise Scale, the custom-priced tier. A team on Business at $45 per seat per month gets the admin panel and SAML single sign-on, and no audit log at all. You find this out when someone asks for one.
Webflow draws the line harder. The site activity log and its API belong to the Team plan, which the pricing page lists at $2,500 a month with an annual contract required. Below that, on Basic at $15 or Premium at $25, the record of who published what does not exist as a product. Retool is friendlier: audit logging starts on Business at $50 per builder per month billed annually, though streaming those logs to Datadog or Splunk waits for Enterprise.
I do not think any of this is unreasonable pricing. Vendors put compliance features where compliance budgets are, and that is ordinary. It just means the log is a line item rather than a property of your system, and line items get cut.
Retention is the part that actually bites
Airtable stores and searches audit log events for 180 days. Not configurable, not extendable, 180 days. The same company will let Enterprise Scale customers set custom revision history timeframes, so the constraint is a decision rather than a physical limit, and it is not a decision you get to make. Retool's cloud logs are retained for a year, but the date range selector on the Audit logs page only shows the past three months and you download the rest.
Then GDPR Article 28(3)(h) turns up and says a processor must make available to the controller all information necessary to demonstrate compliance, and must allow for and contribute to audits and inspections. Your DPA inherits that obligation whether or not your audit log reaches back far enough to satisfy it. A question about an export that happened last July arrives in March, and 180 days has quietly eaten the answer.
Airtable's admin panel also caps a single query at 10,000 events and tells you to add filters or use the API. For a busy base that is a few days of activity. The API paginates at 1,000 events per response, so pulling a real year means writing the export job yourself, which is a piece of engineering you were supposedly avoiding.
What the log looks like when you own it
Retool documents the shape well, oddly enough for the opposite case. Self-hosted instances write to an audit_trail_events table in Postgres with columns for actionType, userId, ipAddress and metadata, and the docs say plainly: you manage your own audit log retention. That is the whole difference. On your own database an audit trail is a table. You join it, you index it, you keep it for seven years if your industry says seven years, and nobody reprices it.
When we moved Stay World Class off Webflow and Xano onto Next.js, NestJS and Supabase, the part that took the longest was a four-stage ETL that mapped every legacy ID onto a PostgreSQL UUID. Tedious work. It is also the reason a record created in the old system is still resolvable in the new one, which is exactly what an auditor is asking for when they say show me the history of this account. The Lighthouse score going from 55.91 to 91 was the visible win. The traceable history was the one that mattered to their compliance review.
None of this needs a heroic platform. Postgres row-level triggers writing to an append-only table cover most of it, and the tooling around that is decades old.
When you should stay exactly where you are
If nobody has asked you for a SOC 2 report, your DPA does not name specific audit obligations, and you are not handling health or payment data, 180 days of retention is more than you will ever read. Airtable's revision history answers the everyday version of the question, which is who broke this view, and it answers it in about four seconds. Migrating to get a longer log is a bad trade when nothing is pulling on the log.
The trigger is a commitment, not a feeling. An enterprise customer's security questionnaire, a regulator, an insurer, a signed DPA with real audit language. Until one of those lands, staying put is the cheaper and saner call. After one lands, the useful question is not whether the platform has audit logs. It is whether you can still get at the history when the contract ends.
