Which logs exist, what is in them, how long they are kept and who watches them.
01What is logged
| Log | Contents | Retention |
|---|---|---|
| Edge access log | Time, method, host, path, client IP, status, duration | 30 days |
| Application log | Authenticated user ID, route, outcome, errors | 30 days |
| Database log | Server events, slow operations, replica set changes | 30 days |
| System log | Service starts and stops, updates, agent events | 30 days |
| AWS CloudTrail | Every administrative AWS API call and remote command | 90 days |
All logs are shipped to Amazon CloudWatch Logs in Frankfurt, where access is restricted by IAM.
02Privacy in logs
- Passwords, tokens and secret values are not logged. Deployment tooling is configured never to write module arguments to server logs.
- Browser error reports record the error and its location only; response bodies, headers and URL query strings are removed before they are sent.
- Logs that could capture typed input are deliberately kept off the central log store.
- Logs are deleted automatically when their 30-day retention ends.
03Monitoring and alerting
- Every server has alarms for health, resource usage and service restarts.
- An external dead-man’s-switch check probes the public site, the API and certificate validity around the clock; if the probe itself stops reporting, the alert still fires.
- Failed sign-in bursts, API errors and client errors are queryable centrally during investigations.
04Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.