[{"data":1,"prerenderedAt":989},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-compliance":424,"-use-cases-audit-compliance-surround":984},[4,25,75,230,338,393],{"title":5,"path":6,"stem":7,"children":8,"page":24},"Start","\u002Fstart","1.start",[9,14,19],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fstart\u002Finstallation","1.start\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F3.quick-start","i-lucide-zap",false,{"title":26,"path":27,"stem":28,"children":29,"page":24},"Learn","\u002Flearn","2.learn",[30,35,40,45,50,55,60,65,70],{"title":31,"path":32,"stem":33,"icon":34},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":36,"path":37,"stem":38,"icon":39},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":41,"path":42,"stem":43,"icon":44},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":46,"path":47,"stem":48,"icon":49},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":51,"path":52,"stem":53,"icon":54},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":56,"path":57,"stem":58,"icon":59},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":61,"path":62,"stem":63,"icon":64},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":66,"path":67,"stem":68,"icon":69},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":71,"path":72,"stem":73,"icon":74},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":76,"path":77,"stem":78,"children":79,"page":24},"Integrate","\u002Fintegrate","3.integrate",[80,84,147],{"title":31,"path":81,"stem":82,"icon":83},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":85,"path":86,"stem":87,"children":88,"page":24},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[89,92,132],{"title":31,"path":90,"stem":91,"icon":34},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":93,"path":94,"stem":95,"children":96,"page":24},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[97,102,107,112,117,122,127],{"title":98,"path":99,"stem":100,"icon":101},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":103,"path":104,"stem":105,"icon":106},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":108,"path":109,"stem":110,"icon":111},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":113,"path":114,"stem":115,"icon":116},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":118,"path":119,"stem":120,"icon":121},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":123,"path":124,"stem":125,"icon":126},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":128,"path":129,"stem":130,"icon":131},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":133,"path":134,"stem":135,"children":136,"page":24},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[137,142],{"title":138,"path":139,"stem":140,"icon":141},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":143,"path":144,"stem":145,"icon":146},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":148,"path":149,"stem":150,"children":151,"page":24},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[152,156,161,166,171,176,181,186,191,196,201,206,211,216,220,225],{"title":31,"path":153,"stem":154,"icon":155},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":157,"path":158,"stem":159,"icon":160},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":162,"path":163,"stem":164,"icon":165},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":167,"path":168,"stem":169,"icon":170},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":172,"path":173,"stem":174,"icon":175},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":177,"path":178,"stem":179,"icon":180},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":182,"path":183,"stem":184,"icon":185},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":187,"path":188,"stem":189,"icon":190},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":192,"path":193,"stem":194,"icon":195},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":197,"path":198,"stem":199,"icon":200},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":202,"path":203,"stem":204,"icon":205},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":207,"path":208,"stem":209,"icon":210},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":212,"path":213,"stem":214,"icon":215},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":217,"path":218,"stem":219,"icon":69},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":221,"path":222,"stem":223,"icon":224},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":226,"path":227,"stem":228,"icon":229},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":231,"path":232,"stem":233,"children":234,"page":24},"Use Cases","\u002Fuse-cases","4.use-cases",[235,239,244,273,301,333],{"title":31,"path":236,"stem":237,"icon":238},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":240,"path":241,"stem":242,"icon":243},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":245,"icon":246,"path":247,"stem":248,"children":249,"page":24},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[250,253,258,263,268],{"title":31,"path":251,"stem":252,"icon":34},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":254,"path":255,"stem":256,"icon":257},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":259,"path":260,"stem":261,"icon":262},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":264,"path":265,"stem":266,"icon":267},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":269,"path":270,"stem":271,"icon":272},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":274,"icon":275,"path":276,"stem":277,"children":278,"page":24},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[279,282,287,292,296],{"title":31,"path":280,"stem":281,"icon":34},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":283,"path":284,"stem":285,"icon":286},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":288,"path":289,"stem":290,"icon":291},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":293,"path":294,"stem":295,"icon":243},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":297,"path":298,"stem":299,"icon":300},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":302,"icon":303,"path":304,"stem":305,"children":306,"page":24},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[307,310,315,320,325,329],{"title":31,"path":308,"stem":309,"icon":34},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":311,"path":312,"stem":313,"icon":314},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":316,"path":317,"stem":318,"icon":319},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":321,"path":322,"stem":323,"icon":324},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":326,"path":327,"stem":328,"icon":303},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":330,"path":331,"stem":332,"icon":74},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":334,"path":335,"stem":336,"icon":337},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":339,"path":340,"stem":341,"children":342,"page":24},"Extend","\u002Fextend","5.extend",[343,347,352,357,362,366,370,374,378,383,388],{"title":31,"path":344,"stem":345,"icon":346},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":348,"path":349,"stem":350,"icon":351},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":353,"path":354,"stem":355,"icon":356},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":358,"path":359,"stem":360,"icon":361},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":330,"path":363,"stem":364,"icon":365},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":367,"path":368,"stem":369,"icon":346},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":371,"path":372,"stem":373,"icon":337},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":375,"path":376,"stem":377,"icon":59},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":379,"path":380,"stem":381,"icon":382},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":384,"path":385,"stem":386,"icon":387},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":389,"path":390,"stem":391,"icon":392},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":394,"path":395,"stem":396,"children":397,"page":24},"Reference","\u002Freference","6.reference",[398,403,406,411,415,420],{"title":399,"path":400,"stem":401,"icon":402},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":297,"path":404,"stem":405,"icon":300},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":407,"path":408,"stem":409,"icon":410},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":412,"path":413,"stem":414,"icon":303},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":416,"path":417,"stem":418,"icon":419},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":421,"path":422,"stem":423,"icon":337},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":425,"title":326,"body":426,"description":973,"extension":974,"links":975,"meta":980,"navigation":981,"path":327,"seo":982,"stem":328,"__hash__":983},"docs\u002F4.use-cases\u002F4.audit\u002F05.compliance.md",{"type":427,"value":428,"toc":966},"minimark",[429,442,447,450,563,586,595,599,606,730,768,772,775,788,801,805,808,867,870,874,962],[430,431,432,433,437,438,441],"p",{},"Compliance frameworks (SOC2, HIPAA, GDPR, PCI) ask the same five questions of every audit log: ",[434,435,436],"strong",{},"who, what, when, from where, with which outcome",", plus ",[434,439,440],{},"how do we know it wasn't tampered with",". evlog answers each one through composition of the existing primitives.",[443,444,446],"h2",{"id":445},"integrity","Integrity",[430,448,449],{},"Hash-chain the audit log so any tampering is detectable. Each event's hash includes the previous hash, so deleting a row breaks the chain forward of that point.",[451,452,457],"pre",{"className":453,"code":454,"language":455,"meta":456,"style":456},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","auditOnly(\n  signed(createFsDrain({ dir: '.audit' }), { strategy: 'hash-chain' }),\n  { await: true },\n)\n","typescript","",[458,459,460,473,539,557],"code",{"__ignoreMap":456},[461,462,465,469],"span",{"class":463,"line":464},"line",1,[461,466,468],{"class":467},"s2Zo4","auditOnly",[461,470,472],{"class":471},"sTEyZ","(\n",[461,474,476,479,482,485,487,491,495,498,501,505,508,511,514,517,520,523,525,527,530,532,534,536],{"class":463,"line":475},2,[461,477,478],{"class":467},"  signed",[461,480,481],{"class":471},"(",[461,483,484],{"class":467},"createFsDrain",[461,486,481],{"class":471},[461,488,490],{"class":489},"sMK4o","{",[461,492,494],{"class":493},"swJcz"," dir",[461,496,497],{"class":489},":",[461,499,500],{"class":489}," '",[461,502,504],{"class":503},"sfazB",".audit",[461,506,507],{"class":489},"'",[461,509,510],{"class":489}," }",[461,512,513],{"class":471},")",[461,515,516],{"class":489},",",[461,518,519],{"class":489}," {",[461,521,522],{"class":493}," strategy",[461,524,497],{"class":489},[461,526,500],{"class":489},[461,528,529],{"class":503},"hash-chain",[461,531,507],{"class":489},[461,533,510],{"class":489},[461,535,513],{"class":471},[461,537,538],{"class":489},",\n",[461,540,542,545,548,550,554],{"class":463,"line":541},3,[461,543,544],{"class":489},"  {",[461,546,547],{"class":493}," await",[461,549,497],{"class":489},[461,551,553],{"class":552},"sfNiH"," true",[461,555,556],{"class":489}," },\n",[461,558,560],{"class":463,"line":559},4,[461,561,562],{"class":471},")\n",[564,565,566,573,574,577,578,581,582,585],"warning",{},[434,567,568,569,572],{},"Rotate ",[458,570,571],{},"secret"," for HMAC-signed audits annually."," When you rotate, embed a key id alongside the signature (e.g. extend ",[458,575,576],{},"AuditFields"," with ",[458,579,580],{},"keyId"," via ",[458,583,584],{},"declare module",") so old events stay verifiable against the previous secret. Verifiers should look up the key by id, not assume a single global secret.",[430,587,588,589,594],{},"See ",[590,591,593],"a",{"href":592},"\u002Fuse-cases\u002Faudit\u002Fpipeline#signed","Drains & Integrity"," for the difference between HMAC and hash-chain.",[443,596,598],{"id":597},"redact","Redact",[430,600,601,602,605],{},"Audit events run through your existing ",[458,603,604],{},"RedactConfig",". Compose with the strict audit preset to harden PII handling:",[451,607,609],{"className":453,"code":608,"language":455,"meta":456,"style":456},"import { auditRedactPreset } from 'evlog'\n\ninitLogger({\n  redact: {\n    paths: [\n      ...(auditRedactPreset.paths ?? []),\n      'user.password',\n    ],\n  },\n})\n",[458,610,611,635,641,651,661,672,695,708,716,722],{"__ignoreMap":456},[461,612,613,617,619,622,624,627,629,632],{"class":463,"line":464},[461,614,616],{"class":615},"s7zQu","import",[461,618,519],{"class":489},[461,620,621],{"class":471}," auditRedactPreset",[461,623,510],{"class":489},[461,625,626],{"class":615}," from",[461,628,500],{"class":489},[461,630,631],{"class":503},"evlog",[461,633,634],{"class":489},"'\n",[461,636,637],{"class":463,"line":475},[461,638,640],{"emptyLinePlaceholder":639},true,"\n",[461,642,643,646,648],{"class":463,"line":541},[461,644,645],{"class":467},"initLogger",[461,647,481],{"class":471},[461,649,650],{"class":489},"{\n",[461,652,653,656,658],{"class":463,"line":559},[461,654,655],{"class":493},"  redact",[461,657,497],{"class":489},[461,659,660],{"class":489}," {\n",[461,662,664,667,669],{"class":463,"line":663},5,[461,665,666],{"class":493},"    paths",[461,668,497],{"class":489},[461,670,671],{"class":471}," [\n",[461,673,675,678,681,684,687,690,693],{"class":463,"line":674},6,[461,676,677],{"class":489},"      ...",[461,679,680],{"class":471},"(auditRedactPreset",[461,682,683],{"class":489},".",[461,685,686],{"class":471},"paths ",[461,688,689],{"class":489},"??",[461,691,692],{"class":471}," [])",[461,694,538],{"class":489},[461,696,698,701,704,706],{"class":463,"line":697},7,[461,699,700],{"class":489},"      '",[461,702,703],{"class":503},"user.password",[461,705,507],{"class":489},[461,707,538],{"class":489},[461,709,711,714],{"class":463,"line":710},8,[461,712,713],{"class":471},"    ]",[461,715,538],{"class":489},[461,717,719],{"class":463,"line":718},9,[461,720,721],{"class":489},"  },\n",[461,723,725,728],{"class":463,"line":724},10,[461,726,727],{"class":489},"}",[461,729,562],{"class":471},[430,731,732,733,736,737,740,741,744,745,744,748,744,751,744,754,744,757,760,761,764,765,683],{},"The preset drops ",[458,734,735],{},"Authorization"," \u002F ",[458,738,739],{},"Cookie"," headers and common credential field names (",[458,742,743],{},"password",", ",[458,746,747],{},"token",[458,749,750],{},"apiKey",[458,752,753],{},"cardNumber",[458,755,756],{},"cvv",[458,758,759],{},"ssn",") wherever they appear inside ",[458,762,763],{},"audit.changes.before"," and ",[458,766,767],{},"audit.changes.after",[443,769,771],{"id":770},"gdpr-vs-append-only","GDPR vs append-only",[430,773,774],{},"Append-only audit logs collide with GDPR's right to be forgotten. Recommended pattern today:",[776,777,778,782,785],"ol",{},[779,780,781],"li",{},"Keep audit rows immutable.",[779,783,784],{},"Encrypt PII fields with a per-actor key (held outside the audit store).",[779,786,787],{},"To \"forget\" a user, delete their key — the audit row stays, the chain stays valid, the PII becomes unreadable.",[430,789,790,791,794,795,683],{},"A built-in ",[458,792,793],{},"cryptoShredding"," helper is on the ",[590,796,800],{"href":797,"rel":798},"https:\u002F\u002Fgithub.com\u002FHugoRCD\u002Fevlog\u002Fissues",[799],"nofollow","follow-up roadmap",[443,802,804],{"id":803},"retention","Retention",[430,806,807],{},"Retention is a storage-layer concern by design. evlog's audit layer doesn't enforce retention windows because every supported sink already has a stronger, audited mechanism for it. Pick the one matching your sink:",[809,810,811,824],"table",{},[812,813,814],"thead",{},[815,816,817,821],"tr",{},[818,819,820],"th",{},"Sink",[818,822,823],{},"Retention mechanism",[825,826,827,840,851,859],"tbody",{},[815,828,829,833],{},[830,831,832],"td",{},"FS",[830,834,835,836,839],{},"Combine ",[458,837,838],{},"createFsDrain({ maxFiles })"," with a daily compactor.",[815,841,842,845],{},[830,843,844],{},"Postgres",[830,846,847,848,683],{},"Schedule ",[458,849,850],{},"DELETE FROM audit_events WHERE timestamp \u003C now() - interval '7 years'",[815,852,853,856],{},[830,854,855],{},"Axiom \u002F Datadog \u002F Loki",[830,857,858],{},"Set the dataset retention policy in the platform.",[815,860,861,864],{},[830,862,863],{},"S3 Object Lock",[830,865,866],{},"Configure lifecycle rules + Object Lock retention period.",[430,868,869],{},"Document the chosen window in your security policy. Auditors care about the written rule, not the enforcing component.",[443,871,873],{"id":872},"common-pitfalls","Common Pitfalls",[875,876,877,890,913,919,938,952],"ul",{},[779,878,879,882,883,577,886,889],{},[434,880,881],{},"Logging only successes."," Auditors care most about denials. Always pair ",[458,884,885],{},"log.audit()",[458,887,888],{},"log.audit.deny()"," on the negative branch of every authorisation check.",[779,891,892,898,899,902,903,905,906,744,908,744,910,912],{},[434,893,894,895,683],{},"Leaking PII through ",[458,896,897],{},"changes"," ",[458,900,901],{},"auditDiff()"," runs through your ",[458,904,604],{},", but only if the field paths are listed. Add ",[458,907,743],{},[458,909,747],{},[458,911,750],{},", etc. once globally so you never have to think about it again.",[779,914,915,918],{},[434,916,917],{},"Treating audits as observability."," Don't sample, downsample, or summarise audit events. Force-keep is on by default — don't disable it.",[779,920,921,898,928,930,931,736,934,937],{},[434,922,923,924,927],{},"Conflating ",[458,925,926],{},"actor.id"," with the session id.",[458,929,926],{}," is the stable user id (or system identity). Correlate sessions via ",[458,932,933],{},"context.requestId",[458,935,936],{},"context.traceId",", never via the actor.",[779,939,940,943,944,947,948,951],{},[434,941,942],{},"Forgetting standalone jobs."," Cron tasks, queue workers, and CLIs trigger audit-worthy actions too. Use ",[458,945,946],{},"audit()"," (no request) or ",[458,949,950],{},"withAudit()"," to keep coverage parity with your HTTP routes.",[779,953,954,961],{},[434,955,956,957,960],{},"Skipping ",[458,958,959],{},"await: true"," on the audit drain."," Without it, audits are fire-and-forget — a crash between the event being emitted and the drain flushing means the action happened but no audit row exists.",[963,964,965],"style",{},"html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":456,"searchDepth":475,"depth":475,"links":967},[968,969,970,971,972],{"id":445,"depth":475,"text":446},{"id":597,"depth":475,"text":598},{"id":770,"depth":475,"text":771},{"id":803,"depth":475,"text":804},{"id":872,"depth":475,"text":873},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.","md",[976,979],{"label":593,"icon":324,"to":322,"color":977,"variant":978},"neutral","subtle",{"label":330,"icon":74,"to":331,"color":977,"variant":978},{},{"title":326,"icon":303},{"title":326,"description":973},"vivjgqqQlK6ejj8Rffr7ojYMZ_7LyYr08ydV46uendU",[985,987],{"title":321,"path":322,"stem":323,"description":986,"icon":324,"children":-1},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.",{"title":330,"path":331,"stem":332,"description":988,"icon":74,"children":-1},"File system, Axiom, and Postgres recipes for audit logs, plus mockAudit for tests and the full API reference.",1778365370401]