Struct AuditLogger 

pub struct AuditLogger {
    config: AuditConfig,
    entries: Mutex<Vec<AuditEntry>>,
    last_hmac: Mutex<String>,
}

Audit logger for SOC2/GDPR compliance.

HMAC Chain Integrity

When configured with an HMAC key, the logger maintains a cryptographic chain where each entry’s signature includes the previous entry’s signature. This creates an append-only log that detects tampering or deletion.

The chain starts with GENESIS_HMAC as the “previous” value for the first entry. Each subsequent entry includes the HMAC of the previous entry.

Fields

config: AuditConfig

entries: Mutex<Vec<AuditEntry>>

last_hmac: Mutex<String>

Last HMAC in the chain (for signing new entries).

Implementations

impl AuditLogger

pub fn new() -> Self

Creates a new audit logger with default config.

pub fn with_config(config: AuditConfig) -> Self

Creates a new audit logger with custom config.

pub fn log(&self, event: &MemoryEvent)

Logs an audit event.

pub fn log_entry(&self, entry: AuditEntry)

Logs a custom audit entry.

If an HMAC key is configured, the entry is signed and chained to the previous entry before storage.

fn sign_entry(&self, entry: AuditEntry) -> AuditEntry

Signs an entry with HMAC if configured, updating chain state.

pub fn log_capture(&self, memory_id: &str, namespace: &str)

Logs a capture event.

pub fn log_recall(&self, query: &str, result_count: usize)

Logs a search/recall event.

pub fn log_sync(&self, pushed: usize, pulled: usize)

Logs a sync event.

pub fn log_redaction(&self, memory_id: &str, redaction_types: &[String])

Logs a redaction event.

pub fn log_pii_detection(&self, pii_types: &[String], context: Option<&str>)

Logs a PII detection event for GDPR/SOC2 compliance.

Records when PII is detected in content, including the types of PII found and the count. The actual PII values are NOT logged to avoid storing sensitive data in audit logs.

pub fn log_pii_disclosure( &self, destination: &str, pii_types: &[String], data_subject_id: Option<&str>, purpose: &str, legal_basis: &str, )

Logs a PII disclosure event for GDPR/SOC2 compliance.

Records when data containing PII is disclosed to external systems such as:

• LLM providers (Anthropic, OpenAI, Ollama, etc.)
• Remote sync destinations
• External APIs

The actual PII values are NOT logged to avoid storing sensitive data. Only metadata about the disclosure is recorded.

Arguments

• destination - The external system receiving the data (e.g., “anthropic”, “openai”)
• pii_types - Types of PII being disclosed
• data_subject_id - Optional identifier of the data subject (anonymized)
• purpose - The purpose of the disclosure
• legal_basis - Legal basis for disclosure (e.g., “consent”, “legitimate_interest”)

pub fn log_bulk_pii_disclosure( &self, destination: &str, record_count: usize, pii_categories: &[String], purpose: &str, legal_basis: &str, )

Logs a bulk PII disclosure event for batch operations.

Similar to log_pii_disclosure but for bulk operations involving multiple data subjects or records.

Arguments

• destination - The external system receiving the data
• record_count - Number of records being disclosed
• pii_categories - Categories of PII being disclosed
• purpose - The purpose of the disclosure
• legal_basis - Legal basis for disclosure

pub fn log_denied(&self, action: &str, reason: &str)

Logs an access denied event.

pub fn recent_entries(&self, limit: usize) -> Vec<AuditEntry>

Returns recent audit entries.

pub fn entries_since(&self, since: DateTime<Utc>) -> Vec<AuditEntry>

Returns all entries since a given timestamp.

pub fn cleanup(&self)

Clears old entries beyond retention period.

pub fn verify_chain(&self) -> Result<()>

Verifies the HMAC chain integrity of all entries.

Returns Ok(()) if all entries are valid and properly chained, or an error describing the first invalid entry found.

Errors

Returns an error if:

• No HMAC key is configured
• An entry has an invalid or missing signature
• The chain is broken (entry’s previous_hmac doesn’t match prior signature)

pub const fn is_signing_enabled(&self) -> bool

Returns whether HMAC signing is enabled.

fn event_to_entry(&self, event: &MemoryEvent) -> AuditEntry

Converts a MemoryEvent to an AuditEntry.

fn append_to_file(&self, path: &Path, entry: &AuditEntry) -> Result<()>

Appends an entry to the log file.

Security

• Path canonicalization is performed to prevent TOCTOU race conditions where a symlink could be modified between path validation and file open.
• On Unix, file permissions are set atomically to 0o600 (owner read/write only) at file creation time using OpenOptionsExt::mode() to prevent race conditions.

fn canonicalize_path(path: &Path) -> Result<PathBuf>

Canonicalizes a path, handling non-existent files by canonicalizing the parent.

impl AuditLogger

pub fn generate_access_review( &self, period_start: DateTime<Utc>, period_end: DateTime<Utc>, ) -> AccessReviewReport

Generates an access review report for the specified period.

Arguments

• period_start - Start of the review period
• period_end - End of the review period

Example

use chrono::{Duration, Utc};
use subcog::security::AuditLogger;

let logger = AuditLogger::new();
let end = Utc::now();
let start = end - Duration::days(30);

let report = logger.generate_access_review(start, end);
println!("Total events: {}", report.total_events);

Trait Implementations

impl Default for AuditLogger

fn default() -> Self

Returns the “default value” for a type.