Evidence for auditors and regulators

Last updated: November 9, 2026

Mesh keeps a record of your customers, their screenings, the decisions your team makes, and the actions of every user. You can export most of it yourself and send it to an auditor or a regulator.

This article lists what Mesh records, how to export or retrieve each record, and the permission each one requires.

What Mesh records

Records you can give an auditor

Record	What it holds	Where you get it
Customers	Each customer's details, status, risk level, monitoring status and number of cases	The Customer export
Screenings	Each onboarding screening, the screening configuration and version used, and the number of hits	The Customer screening export
Matches and decisions	Each profile returned, its sources, its status, such as True Positive or False Positive, and the user who last updated it	The Profiles export
Cases and alerts	Each case and alert, its stage, its assignee and, for customer screening cases, the time taken to remediate	The Screening and monitoring cases export and the transaction-related exports
Transactions	Each transaction you submitted and the scenario that evaluated it	The Transactions export
One customer's screening history	Initial screening and ongoing monitoring results, the screening configurations, and each decision with its notes and user	The customer's screening report
Actions and events	Each event on a customer, case, transaction, user, role or account, with who made it and when	The audit logs

The Customer screening export holds onboarding screenings only. Matches found by ongoing monitoring are in the Profiles export, where screening_type reads Monitoring, and in the Screening and monitoring cases export.

Exporting records yourself

Who can export

Creating and downloading an export requires the View and download insights permission. Of the system roles, Supervisor and Admin hold it and Analyst does not, as described in System roles and permissions.

Each export type is available only when your account has the product it covers, for example Transaction Monitoring for the Transactions export.

Creating and downloading an export

Select Insights, then My exports.
Select Create.
Enter an export name, choose the data to export, and select the date range.
Select Create. The export is listed as In progress, then as Completed when the file is ready.
Select Download. The file is saved as a .csv file.

Creating a data export and Downloading a data export show each screen. The columns of each export are listed in Exports for Customer Screening and Monitoring and Transaction-related exports.

The 12-month window

An export's date range can start no earlier than one year before the day you create it, in the web app and through the API alike. A request with an earlier start date is rejected.

Each export selects its rows by one date:

Customer: the date the customer was created.
Customer screening: the date of the screening.
Cases and alerts exports: the date the case was created.
Transactions: the date the transaction occurred.

A customer created before the date range is not in the Customer export, even if it was updated within the range.

For data older than 12 months, contact Technical Support, as described in How to contact support, and give the export type and the date range you need.

Exporting through the API

The data export endpoints in the Mesh API

Endpoint	What it does
GET /v2/exports/export-types	Lists the export types available to your account
POST /v2/exports	Creates an export from an `export_type_key`, a `start_date` and an `end_date`
GET /v2/exports	Lists the exports you created, with their status
GET /v2/exports/{export_identifier}/download	Returns a download link, valid for 5 seconds after it is issued

Every exports endpoint requires the View and download insights permission.

Audit logs

Audit logs are not an export type. You view them in the web app, or retrieve them through the API one record at a time: one customer, case, transaction, user, role or account per request.

Each entry records the event, whether a user or the system made it, and the date and time.

What each audit log records

Audit log	What it records	Where you get it	Permission
Customer	Creation, updates, screenings and rescreens, risk score calculations, cases created and closed	Audit log on the customer page, or GET /v2/audit/customers/{customer_identifier}	View customers
Case	Creation, stage changes and decisions, profile decisions, assignment, notes	Audit log on the case page, or GET /v2/audit/cases/{case_identifier}	The view permission for the case type, for example View onboarding cases
Transaction	Receipt, Transaction Monitoring and Payment Screening results, decisions, cases	GET /v2/audit/transactions/{transaction_identifier}	View transactions
User	Creation, activation and deactivation, name changes, role changes, accounts added or removed	GET /v2/audit/users/{user_identifier}	View users
Role	Creation, name and description changes, permission changes, archiving	GET /v2/audit/roles/{role_identifier}	View roles in account
Account	Creation, activation and deactivation, name changes, account permission, IP restriction and rate limit changes	GET /v2/audit/accounts/me	View all accounts

Viewing audit logs for a customer and Viewing the audit trail for a case show where each panel opens.

Users and roles

For a list of who can access an account, select Settings, then Users under Access management. The list can be filtered by role or status, as described in Managing users.

Roles and permissions, under the same menu, shows every permission each role grants.

Matching a request to a record

What to send for a typical request

The request	What to send
The customers onboarded in a period, and how each was screened	The Customer export and the Customer screening export for that period
How a match was decided, and by whom	The customer's screening report and the audit trail of the case
True positive and false positive decisions across your program	The Profiles export, with `profile_status` and `profile_last_updated_by_user`
The sources a match came from	The Profiles export, with `aml_source_list`
How long customer screening cases took to resolve	The Screening and monitoring cases export, with `time_to_remediate` and `assignee_name`
Transaction monitoring alerts and their outcomes	The Transaction Monitoring cases and alerts export
Who can access Mesh, and with which roles	The Users list filtered by role, and each role in Roles and permissions

Step 8 - Record keeping and audit trails explains what regulators expect your records to show.