Skip to content
Rack Gateway

Data Retention

Rack Gateway stores audit logs in PostgreSQL and can write WORM anchors to S3 for tamper-evident retention. Audit logs are never deleted.

Retention Overview

Section titled “Retention Overview”
  • Primary storage: PostgreSQL (audit.audit_event)
  • WORM anchors: Optional S3 Object Lock bucket

PostgreSQL Retention

Section titled “PostgreSQL Retention”

Audit logs stay in PostgreSQL for the life of the database. audit.audit_event is append-only: triggers refuse every UPDATE and DELETE, and each event’s hash covers the previous one, so removing old events would also break verification of the chain. Plan the database’s storage and backups for the log growing forever (a few hundred bytes per request).

S3 WORM Anchors

Section titled “S3 WORM Anchors”

WORM anchors capture the chain head hash and metadata, not full log exports. Anchors are written periodically (default: hourly) to an Object Lock bucket.

Environment Configuration

Section titled “Environment Configuration”
Terminal window
# Enable anchors
AUDIT_ANCHOR_BUCKET=rack-gateway-audit-anchor-production
AUDIT_ANCHOR_CHAIN_ID=production


# Optional
AUDIT_ANCHOR_INTERVAL_MINUTES=60
AWS_ENDPOINT_URL_S3=http://minio:9000  # MinIO, in development and E2E (testbypass) builds only

Anchor Workflow

Section titled “Anchor Workflow”

  1. Compute chain head

    • Gateway reads the latest audit.audit_event hash

  2. Write anchor payload

    • JSON payload written to S3 with Object Lock retention

  3. Verify

    • The gateway checks the chain and its anchors every hour and alerts when the check fails; rack-gateway-api verify-audit runs the same check by hand

Bucket Setup

Section titled “Bucket Setup”

The bucket needs Object Lock in Compliance mode, versioning, and a default retention as long as your policy requires: that default rule is what locks each anchor. See S3 WORM Storage for example Terraform, the IAM policy and verification.