GDPR Audit Trail

Paid pluginsize Mplanned, not built

Indicative price, not an offer: €24/mo; per-country obligation: GDPR audit logs, deletion proof

Generated from docs/plan/paid/gdpr-audit-trail/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

A paid service providing tamper-proof audit logs of all data access, modification, and deletion events for GDPR compliance. Merchants can prove to regulators that they deleted customer data within 30 days of request, as required by right-to-deletion.

The problem

A French merchant receives a GDPR right-to-deletion request from a customer. She deletes the customer record from her shop. 6 months later, a regulator audits the shop and asks: ‘When was this data deleted? Prove it was within 30 days.’ She has no audit log. She’s fined €10k for non-compliance.

What it does

• Audit log: every data access, modification, deletion is logged (who, what, when, why)
• Deletion proof: when a customer is deleted, timestamp is logged and immutable
• Data retention report: export showing which customer data was deleted and when
• Right-to-deletion tracking: merchant can mark a request as ‘received’ and ‘completed’, audit shows both timestamps
• Staff action log: track which staff member performed which action (for insider threat detection)
• Regulatory report: formatted for GDPR inspection (exportable PDF with audit evidence)
• Data lineage: track which orders/invoices were associated with deleted customer
• Log retention: audit logs are never deleted (even if customer data is deleted)
• Tamper detection: if an audit log entry is modified or deleted, alert merchant

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Data anonymization (we log deletions, not anonymization)—separate feature
• Encryption at rest—handled by infrastructure
• Access control enforcement—handled by core auth system
• Log export to SIEM/external monitoring—out of scope (merchant’s responsibility)
• Automated compliance checks (e.g., ‘are all deletions within 30 days?’)—merchant’s responsibility

Data model

New: AuditLog(id, shopId, actor_id, resource_type, resource_id, action, old_value_hash, new_value_hash, timestamp, reason); DeletionRequest(id, customerId, request_date, completion_date, audit_log_ids). No core migration; stored in plugin/audit infrastructure.

API

• GET /audit-log — list all audit entries (filtered by date, resource type, actor)
• POST /audit-log/export — export audit log as CSV/JSON for inspection
• POST /deletion-requests — create a deletion request, track completion
• GET /deletion-requests/:id — return request with completion timestamp
• GET /audit-log/regulatory-report — export GDPR-formatted audit evidence (PDF)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Audit trail dashboard: log entries (who accessed what, when, why), staff activity timeline, deletion request tracker (received date → completion date), regulatory report generator, tamper alerts

The seam — why this is paid

Core owns: audit log API, capturing core events. Paid pack owns: log retention and immutability (blockchain-like hash chain?), regulatory formatting, compliance reporting.

Per-country obligation: GDPR, we maintain deletion audit trails

Dependencies

• audit log infrastructure (core; must capture all events before storing)
• staff/user system (must track who performed actions)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• A customer is deleted on 2025-09-02 14:00 UTC; audit log shows deletion entry with timestamp
• Deletion request created 2025-08-25, marked completed 2025-08-28 (within 30 days); audit shows both dates
• Exporting audit log as CSV includes columns: actor, action, resource, timestamp, reason
• GDPR regulatory report (PDF) shows: ‘Customer 123 deleted on 2025-09-02, 3 days after request received 2025-08-30’
• Attempting to modify an audit log entry triggers tamper alert (email to admin)
• Audit log shows which staff member deleted the customer (actor_id + name)
• Regulatory report includes all orders/invoices associated with deleted customer (data lineage)
• Audit logs are retained forever (even after customer deletion); they cannot be pruned

Risks

Audit log poisoning: if an admin deletes audit entries, we have no proof of deletion—must implement immutability (e.g., hash chain). Log storage costs: storing every access for large shops costs €€€—must implement retention policies carefully. If audit logs are accidentally wiped (DB crash), merchant has no GDPR evidence. Regulators might not accept our audit format—must align with standard GDPR guidance.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.