Logging & Monitoring Policy¶
| Field | Value |
|---|---|
| Owner | Puneet Gupta (Co-Founder) |
| Classification | Internal (shareable under NDA) |
| Version | 1.0 |
| Effective date | 2026-06-11 |
| Next review | 2027-06-11 |
1. Purpose¶
Define what is logged, how logs are protected and retained, and how activity is monitored.
2. What is logged¶
- Application audit logs — changes to sensitive records and configuration are captured in audit and revision tables (e.g. approval audit log, per-field configuration revision tables), recording the actor and the change.
- Privileged/administrative actions — captured in the same audit/revision logs.
- Infrastructure & security logs — application logs, plus CrowdSec/nginx logs for ingress/perimeter activity; infrastructure access is logged by the cloud provider.
3. Retention¶
Audit and activity records are retained for at least 180 days to support investigation and customer export. (Formal retention standard being finalized.)
4. Export¶
Audit and activity data can be exported and provided to customers on request, e.g. via database/report export of the relevant records. Logs reside in the managed PostgreSQL database (audit/revision tables) and in infrastructure logs.
5. Monitoring & correlation¶
- Perimeter threats are detected and acted on by CrowdSec.
- Centralized aggregation and cross-source correlation via a SIEM is not yet deployed and is planned as part of the security monitoring roadmap. (Planned.) Until then, logs are reviewed from their respective sources during investigation and on alert.
Revision history¶
| Version | Date | Author | Change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-06-11 | Puneet Gupta | Initial draft | Puneet Gupta (Co-Founder) |