Weekday Addepar compliance digest from the audit trail

Every weekday at 7am, produce a compliance security digest from the last 24 hours of Addepar audit trail activity, email it to the compliance team, and post a compact status line to the compliance Slack channel.

Trigger: cron, Monday through Friday at 7:00am in the firm's local timezone. On Monday, extend the lookback to cover the weekend so nothing falls through the gap.

Step 1. Pull the last 24 hours of audit events from Addepar using Get Audit Trail. Fetch every event in the window; do not sample. If the window spans a weekend or a missed run, extend it to cover the gap.

Step 2. Categorize each event into the buckets a compliance officer cares about:

- Failed login attempts and account lockouts (repeat failures for the same user, lockouts, MFA failures)

- Permission or role changes on client-facing users (advisors, client service, external users; scope grants, role escalations, portfolio access changes)

- Edits or deletions of transactions, snapshots, and valuations (especially bulk edits, backdated changes, or deletions on closed periods)

- Off-hours access (activity outside normal business hours in the firm's timezone, weekends, or from unusual geographies if location is present in the event)

- Unusual bulk exports or file downloads (large report generation, mass file downloads, exports of client-identifying data)

Step 3. Suppress benign noise so the digest stays useful. Routine advisor logins from known accounts during business hours, scheduled report runs, and system service accounts performing their normal daily jobs should be omitted from the categorized list (but still counted in totals). Only surface events that are exceptions or need follow-up.

Step 4. Flag anything that looks like a policy exception: repeated failed logins for a single user, permission grants to external or newly-created users, deletions of transactions in prior closed periods, off-hours edits to client data, or a single user pulling an unusually large volume of exports. Call these out at the top of the digest.

Step 5. Write the digest with an executive summary at the top (2 to 4 sentences: total events reviewed, count of exceptions by bucket, and the single most important thing the compliance team should look at first) followed by the categorized event list. Each event line should include the timestamp, the user, what happened, and why it was flagged. Keep it scannable.

Step 6. Send the digest via Gmail Send a Message to the compliance distribution list. Subject line should include the date and the exception count, for example: "Addepar compliance digest — 2026-07-17 — 3 items to review". If there are zero exceptions, say "all clear" in the subject.

Step 7. Post a single compact line to the compliance Slack channel via Slack Send a Message. Format: "Addepar compliance digest for <date>: all clear" when there are no exceptions, or "Addepar compliance digest for <date>: N items to review — see email" when there are. Do not paste the full digest into Slack; keep it a one-liner and link readers to the email.

Formatting rules: neutral, factual tone; no marketing language; no speculation about intent; if the audit trail is empty for the window, still send the email and the Slack line so the compliance team knows the check ran.