Persistent Audit Trails

Bauxite Intercept provides tamper-proof, encrypted audit logs to simplify the compliance burden for organizations handling sensitive data. Unlike traditional proxies that log raw traffic, Bauxite logs only the Metadata of Protection.

The SQLite Vault

For production environments (Shield and Fortress tiers), Bauxite utilizes an Encrypted SQLite database (AES-GCM) to maintain persistent records of redaction events.

What is Logged:

Timestamp: Exact time of detection.
Request ID: A unique, non-PII trace ID.
Event Type: The category of detection (e.g., REDACTION).
Context: The specific PII label triggered (e.g., [EMAIL_1]).

What is NEVER Logged:

The original sensitive data (e.g., the actual email address).
The full request or response body.

Regulatory Compliance

Bauxite helps teams satisfy requirements for major security frameworks:

Framework	Control	Bauxite Implementation
SOC 2	CC7.2 (Monitoring)	Real-time logging of every PII mitigation event.
HIPAA	164.312 (Access Control)	Automated scrubbing of PHI at the network perimeter.
GDPR	Art. 25 (Privacy by Design)	Ephemeral handling of raw data with encrypted metadata logs.

Auditor Verification Steps

1. Verify Encrypted Storage

Even if an attacker gains access to the sidecar’s disk, they cannot read the audit logs without the Master Encryption Key.

# Attempt to read the database file
sqlite3 /tmp/intercept.db "SELECT * FROM audit;"
# Output: Error: file is encrypted or is not a database

2. Generate a Governance Report

Show auditors a consolidated view of prevented leaks over a 30-day window:

./bin/intercept report generate

3. Real-time Log Tailing

Monitor protection events as they happen:

./bin/intercept log

Log Retention (TTL)

Audit logs are automatically rotated based on your tier:

Open Core: 1 Hour (Volatile).
Shield: 30 Days.
Fortress: Customizable/Infinite.

The background Cleanup Worker ensures that the database remains small and performant by pruning expired entries every hour.