Logging & retention

<h2>Log categories and retention</h2> <table><thead><tr><th>Category</th><th>Source</th><th>Retention</th><th>Access</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>Audit log</strong></td><td>Firestore <code>auditLog</code> (append-only)</td><td>2 years</td><td>Security Officer, admins (read-only UI)</td><td>Forensics, compliance, access reviews</td></tr><tr><td><strong>AI call audit</strong></td><td>Firestore <code>aiCallAudit</code> (metadata only: no prompts/completions)</td><td>1 year</td><td>Security Officer, Privacy Officer / data-protection contact</td><td>AI governance, anomaly detection</td></tr><tr><td><strong>Security audit monitor runs</strong></td><td>Firestore <code>securityAuditMonitorRuns</code></td><td>365 days</td><td>Security Officer</td><td>Hourly audit-log anomaly-monitor evidence</td></tr><tr><td><strong>Application error logs</strong></td><td>Sentry</td><td>90 days</td><td>Engineering</td><td>Debugging, performance</td></tr><tr><td><strong>Performance traces</strong></td><td>Sentry (10% sample)</td><td>90 days</td><td>Engineering</td><td>Performance</td></tr><tr><td><strong>Platform logs</strong></td><td>Vercel logs + enabled Vercel log drain to Sentry for production/preview selected sources</td><td>Vercel vendor retention; Sentry retention 90 days</td><td>Security Officer, Engineering</td><td>Ops visibility</td></tr><tr><td><strong>Firebase Auth logs</strong></td><td>GCP Logging</td><td>400 days (GCP default)</td><td>Security Officer</td><td>Auth forensics</td></tr><tr><td><strong>Stripe webhook logs</strong></td><td>Stripe dashboard</td><td>180 days</td><td>Engineering</td><td>Payment ops</td></tr><tr><td><strong>Mail delivery logs</strong></td><td>SendGrid dashboard</td><td>30 days activity + 90 days suppressions</td><td>Security Officer, Engineering</td><td>Deliverability</td></tr><tr><td><strong>Deleted-user audit</strong></td><td>Firestore <code>deleted_users</code></td><td>365 days</td><td>Security Officer</td><td>Fraud / abuse detection, restoration</td></tr><tr><td><strong>Recovery snapshots</strong></td><td>Firestore <code>deleted_account_snapshots</code></td><td>30 days</td><td>Automated only</td><td>Accidental-deletion recovery</td></tr><tr><td><strong>Account-deletion feedback</strong></td><td>Firestore <code>deleted_account_feedback</code></td><td>365 days</td><td>Privacy Officer / data-protection contact + Product</td><td>Churn signal</td></tr><tr><td><strong>Break-glass log</strong></td><td>Internal record</td><td>Permanent</td><td>Security Officer</td><td>Governance</td></tr><tr><td><strong>Incident post-mortems</strong></td><td>Internal record</td><td>Permanent</td><td>Security Officer</td><td>Lessons learned</td></tr></tbody></table> <h2>PII handling in logs</h2> <ul><li>Sentry has <code>beforeSend</code> hooks that scrub known PII fields (email, resume, contact names) before transmission.</li><li>Audit log records user IDs (UIDs), never prompts or resume content.</li><li>AI call audit records metadata (tokens, duration, model) and a <strong>hash</strong> of the prompt, never the prompt itself.</li><li>Vercel request logs contain URLs and headers; we avoid putting PII in URLs (use POST bodies or opaque IDs).</li><li>Mail logs contain recipient email (Confidential): retained by SendGrid per their policy.</li></ul> <h2>Tamper resistance</h2> <ul><li>The Firestore audit log is append-only at the rules layer: client SDK writes, updates, and deletes are denied for all users (including administrators); only server-side admin SDK code can write. The same no-client-write posture applies to the AI call audit and the security-monitor-run collections.</li><li>Firestore rules prevent client-side audit-log mutation. Firestore PITR and managed daily backups are enabled in live GCP and can support recovery within their retention windows.</li><li>Sentry data and Vercel drained logs are tamper-resistant at the vendor level.</li></ul> <h2>Time synchronization</h2> <ul><li>Server clocks use the hosting platform&#39;s NTP synchronization (Vercel + GCP): sub-second accuracy.</li><li>Timestamps in audit log use UTC.</li></ul> <h2>Export to customers</h2> <ul><li>The self-service account export includes the user&#39;s profile, user-owned subcollections, subscription row, linked authentication/session records, and user-specific <code>auditLog</code> and <code>aiCallAudit</code> rows.</li><li><code>securityAuditMonitorRuns</code> stores monitor metadata and hashed actor/IP identifiers for findings; it is internal operating evidence, not a customer-facing event log.</li><li>Institution-scoped audit-log export and SIEM integration are available on enterprise engagement.</li></ul> <h2>Alerting</h2> <ul><li>Sentry: issue alerting and the Sentry safety-net GitHub workflow are configured for production error visibility.</li><li>Audit-log anomaly monitoring runs hourly and queries the audit log for failed MFA bursts, MFA disablement, high admin mutation volume, all-session revocation bursts, and emergency-change creation. Findings are retained in the security-monitor-run collection and reported to Sentry.</li><li>Stripe webhook failures route through the application&#39;s webhook error handling and notification workflows.</li><li>Log-pipeline failures (e.g., missing audit-log writes) are captured to Sentry.</li></ul> <h2>Retention enforcement</h2> <ul><li>A scheduled retention enforcement job runs daily and enforces TTLs for short-lived records and timestamp cutoffs for the audit log and the AI call audit.</li><li>Longer retention targets currently enforced by the same runner: audit log 2 years, AI call audit 1 year, security-monitor-runs 365 days, and deleted-user records 365 days.</li><li>Vercel + Sentry retention is vendor-configured.</li></ul> <h2>Review</h2> <p>Retention policy reviewed annually; quarterly sanity check in internal audit that:</p> <ul><li>Cron enforcement is running (see its log)</li><li>Audit-log volume matches expected activity</li><li>Sentry ingest is operating</li></ul> <h2>Related</h2> <ul><li><a href="/trust/docs/information-security-policy">Information security policy</a></li><li><a href="/trust/docs/incident-response">Incident response</a></li><li><a href="/trust/docs/internal-audit">Internal audit program</a></li><li><a href="/trust/docs/data-retention">Data retention policy</a></li></ul>