Audit Log & Compliance Retention

Every meaningful action in the platform routes through a central write_audit_log service that persists to a unified AuditLog collection. The schema is fixed: domain (one of 13 categories — IDENTITY, LICENSE, COMPETITION, FINANCE, DISCIPLINARY, CAPABILITY, ...), action, entity_type, entity_id, actor_id, tenant_id, timestamp, IP, user-agent, details payload and an auto-generated search_text field. The contract is append-only and immutable — there is no update or delete endpoint and the underlying collection has no expireAfterSeconds TTL — so a forensic investigator can trust the trail end to end.

Reads go through GET /audit-log/ with filters, plus dedicated entity-trail and actor-trail endpoints that list every action against a record or by a user. The /audit-log/search?q= endpoint runs a Cosmos-DB-compatible regex case-insensitive query over search_text with domain and date filters and cursor pagination, so an admin looking for everything that touched a contested license number gets it without writing a query.

Discipline and finance get extended trails layered on top of the central write. DisciplinaryAuditEntry adds IP, user-agent and entity_type plus a 30-action enum spanning case lifecycle, hearing, sanction, appeal, ADR and CAS escalation; write_discipline_audit dual-writes to both the extended store and the central log so cross-domain queries still work. write_finance_audit covers all 80+ FinancialAuditAction types with enriched amount/currency in details. Retention is unlimited (AUDIT_LOG_RETENTION_DAYS=0) on the legal basis of GDPR Art. 6(1)(f); a validate_retention_policy service flags any tenant trying to set non-compliant policies.

GDPR integration runs on top: export_audit_logs_for_user collects every entry where the user is actor and surfaces them through GET /me/data-export (Art. 20). For Art. 17 erasure, anonymise_audit_logs_for_user replaces PII in place — actor_id → null, IP → 0.0.0.0, UA → ANONYMISED, marked PII keys in details → ANONYMISED — and sets is_anonymised, never deleting the row so the audit trail's integrity stays intact. PII fields are classified per-field through a PIICategory enum (identity / network / behavioural / contextual) with json_schema_extra tags, an AuditLog.pii_fields() classmethod, ANONYMISATION_RULES and a public schema endpoint at /audit-log/pii-schema.