Skip to main content
aivault maintains an append-only audit log that records every secret lifecycle event and proxied invocation. The log is designed for compliance, forensics, and anomaly detection.

​
What gets logged

​
Viewing the log

​
Storage

Audit events are stored as newline-delimited JSON (JSONL) files in the vault directory:
Each event includes:
  • Timestamp (milliseconds since epoch)
  • Event type
  • Relevant IDs (secret, credential, capability)
  • Execution context (workspace, group, client IP)

​
Disabling disk logs

For environments where audit logs should not be written to disk (e.g. ephemeral containers), set:
This suppresses all disk-based audit logging. Events are still processed in-memory for rate limiting and policy enforcement.

​
Using audit logs

Compliance: the audit log provides a complete record of who accessed what and when, suitable for SOC 2, HIPAA, and similar compliance frameworks. Forensics: if a secret is suspected of being misused, the audit log shows every invocation that used it, including the capability, client IP, and workspace context. Anomaly detection: monitor for unusual patterns — spikes in invocation frequency, requests from unexpected workspace contexts, or capabilities that shouldn’t be active. Next: Registry