Audit & Compliance

Audit logs record changes to platform resources. Access logs record reads of sensitive data. Together with security events and data-protection controls, they support investigations and compliance work.

Audit Logging

Each operation that changes state creates an immutable audit record. Users cannot change or delete these records. Audit data remains separate for each tenant.

What Is Logged

Audit records include these details:

• Each create, update, or delete operation.
• The actor's user ID and name.
• The tenant, division, environment, and deployment involved.
• Previous and new values for updates.
• The time of the operation.

Viewing Audit Logs

1. Open the tenant or deployment in the Console.
2. Open the Audit tab.
3. Browse or search its history.

Tenant Isolation

The platform stores each tenant's audit data separately. One tenant cannot read another tenant's records.

Encryption

The platform encrypts audit data at rest, including actor names, resource names, and event payloads.

Access Logs

Access logs identify reads of sensitive information. They record the request ID, actor, action, IP address, and User-Agent. The recorded reads include these:

• User profiles.
• Member lists.
• Invitations.
• Audit logs.
• Personal data exports.

Security Events

Permission-denied events record attempts to perform unauthorized actions. Authentication-failure events record failed sign-ins, their reasons, and request details. Use these events to investigate unusual activity and incidents.

Data Protection (GDPR)

Encryption at Rest

The platform encrypts personally identifiable information, data that identifies a person, at rest. This includes emails, names, identity-provider external IDs, invitation emails, and personal information in audit fields.

One-way email hashes support account lookups. The platform can find an account without decrypting every record.

Data Export

Users can export their personal data as JSON through the Console or API. The export contains these records:

• Profile information.
• Identity-provider connections.
• Active sessions.
• Tenant memberships.
• Pending invitations.
• Account configuration.

Right to Erasure

Deleting a user account removes its identities, memberships, and invitations. The platform retains audit logs for security under legitimate interest, as permitted by GDPR.

Audit Retention

Reading audit logs requires tenant-level audit:read.

API Reference

Get Audit Event Types

Retrieve the event types available for filtering:

curl https://api.laserdata.cloud/audit/types \
  -H "ld-api-key: YOUR_API_KEY"

Get Tenant Audit Logs

curl "https://api.laserdata.cloud/audit/tenants/{tenant_id}?page=1&results=10" \
  -H "ld-api-key: YOUR_API_KEY"

{
  "items": [
    {
      "type": "deployment_created",
      "name": "Deployment Created",
      "author": { "id": 608123456789012345, "name": "Jane Smith" },
      "api_key": { "id": 67890, "name": "ci-deploy-key" },
      "division": { "id": 615380456123456790, "name": "Platform Engineering" },
      "environment": { "id": 1, "name": "production" },
      "deployment": { "id": 611298765432109056, "name": "events-prod" },
      "timestamp": "2025-01-15T10:30:00Z"
    }
  ],
  "page": 1,
  "total_results": 1,
  "total_pages": 1
}

Each entry identifies a person in author. Automated calls also identify their api_key. Both use {id, name} pairs. Filter with &author={user_id} for a person or &api_key={api_key_id} for a key. See the API reference for the complete response and filters.

User activity history and personal data export require a user session. Open them from account configuration in the Console. Tenant-scoped API keys cannot read user-account data.