sapaudit
SAP SECURITY · AUDIT · COMPLIANCE

Every SAP logon, change and authorization. On one audit trail.

sapaudit turns the Security Audit Log, change documents and authorization data of your SAP systems into reports an auditor can read — and Sage AI flags the activity that does not fit before anyone has to ask.

Request a demo See what it audits
SAP AUDIT TRAIL SAMPLE DATA
SM20Transaction SE16 startedby FI_USER07 · PRD/100 · 10:42RECORDED
CDHDRVendor bank details changedby AP_CLERK3 · PRD/100 · 11:05RECORDED
SUIMRole assigned to dialog userby SEC_ADM01 · PRD/100 · 14:30RECORDED
SM20SAP_ALL profile assignedby BASIS_02 · PRD/100 · 02:14ANOMALY
Who · whatWhen · where
Before · afterOn every change
Sage AIAnomaly detection
WHY SAPAUDIT

SAP already records it. Reading it is the hard part.

The evidence sits in SM20, SUIM, change document tables and traces: one system, one transaction and one expert at a time. sapaudit turns it into a record people can read and a signal people can act on.

Answer the auditor in minutes

Evidence for a control is a saved report, not a week of running transactions and assembling spreadsheets.

See risk before it is a finding

Critical authorizations, dormant privileged users and risky role combinations are listed before the audit does it for you.

Notice what does not fit

Sage AI learns how each user normally works and raises the activity that breaks the pattern.

One trail for the landscape

The same who, what, when and where across every SAP system and client you run.

AUDIT COVERAGE

Built on the audit sources SAP itself provides.

Each source answers a different question. sapaudit keeps them together, so one finding can be followed from the logon to the change to the authorization that allowed it.

USER ACTIVITY Security Audit Log Logons, started transactions and security events from the Security Audit Log.
SM20SM20NLogonsTransaction starts
Explore →
ACCESS Users, roles and authorizations Users, roles, profiles and the critical authorizations behind them.
SUIMUsersRolesProfiles
Explore →
CHANGE Change documents Changes to financial documents and master data, with old and new values.
CDHDRCDPOSS_ALR_87012293Financial documents
Explore →
TRACE System trace Authorization checks, RFC calls, database operations and kernel traces.
ST01Authorization checksRFC callsDatabase operations
Explore →
BUSINESS ONE SAP Business One Changes to documents and master data in SAP Business One.
SAP Business OneChange logDocumentsMaster data
Explore →
SUPPORTED SAP SYSTEMS
SAP S/4HANASAP ECCSAP S/4HANA CloudRISE with SAPSAP Business OneSAP BTP
CAPABILITIES

From a raw log line to an answer.

Activity and change auditing

Every recorded event carries who did it, when, in which system and client — and for changes, the value before and after.

Authorization reporting

Standing reports on critical authorizations, privileged users and role changes.

Real-time alerts

Be told at once about the events that should never happen quietly: broad profiles, audit log changes, mass data changes.

Sage AI anomaly detection

Behaviour baselines per user and system, with every anomaly explained in plain language.

Search and investigation

Ask across all systems at once and follow one user through everything they touched.

Compliance reports

Reports organised by the control they evidence, ready to hand over.

See how the platform works →
SAGE AI

The log tells you what happened. Sage AI tells you what was unusual.

An authorised action is not always a normal one. Sage AI compares each event with the history of the user and system behind it, and explains why it stood out.

How Sage AI works
ILLUSTRATIVE EXAMPLES
SAP_ALL assigned at 02:14SAGE AI

This administrator has never assigned a broad profile in production, and has no activity outside working hours in their history.

Vendor bank details changed before a payment runSAGE AI

The account was changed by a user outside the team that maintains vendors, and changed back the next morning.

COMPLIANCE

Evidence for the standards you answer to.

The same trail serves each of them. Reports are grouped by requirement so the right evidence is one click away.

SOXKVKKGDPRISO/IEC 27001PCI DSSNIS2DORAHIPAA
See how evidence maps to each standard →
USE CASES

Built for the audit. Useful every other day of the year.

COMPLIANCE SOX and financial audit preparation Hand over evidence for access and change controls without assembling it by hand. All use cases → SECURITY Privileged user monitoring Know at once when broad authorizations are granted, used or abused. All use cases → SAGE AI Fraud and misuse signals Catch the master data change or the data extraction that does not match the user behind it. All use cases →

See your own SAP audit trail.

Connect one system and watch the first day of activity turn into answers.

Request a demo