> Raw Markdown twin (generated at build time from the source Markdown). Rendered page: https://docs.gatellm.io/en/usecases/compliance-audit · Doc index: https://docs.gatellm.io/en/llms.txt


# Meet compliance and audit requirements

Compliance requirements usually boil down to four questions: who called what, what the call content was, whether sensitive information leaked, and how long it's retained before deletion. The gateway's logging, redaction, audit, and security configuration answer these respectively.

## Mapping common compliance requirements

| Compliance requirement | Gateway capability | Configured at |
|---------|---------|--------|
| Who called which model and when | Request logs + access key name/group | [Logs viewer](/en/console/logs-viewer.md) |
| Request/response content retention | Log body capture (including SSE disk spill) | [Log and log-body storage](/en/reference/logs-and-body-storage.md) |
| Sensitive-information redaction | Response-script redaction + log-body masking | [Response redaction with scripts](/en/howto/script-response-redact.md) |
| Login and permission audit | Console sessions, roles, audit logs | [Console login and roles](/en/console/login-and-roles.md) |
| Retention period and deletion | Log retention days, body capture limit | [Log and log-body storage](/en/reference/logs-and-body-storage.md) |

## Request and response retention

- Each request has a unique `z-request-id` header (`<iso8601>-<uuid4>`), injected into the request header, mirrored to the response header, forwarded to the upstream, and embedded in all structured logs. This ID is how you locate a specific request. See [Export billing Excel and troubleshoot logs](/en/howto/billing-export-and-logs.md).
- Log details contain four segments: client request / upstream request / upstream response / error. The streaming response body is recorded by a background task after the stream ends; an abnormally interrupted stream is marked `body_incomplete`.

## Sensitive-information redaction (two layers)

::: warning The two redaction layers each handle one segment
- **Response-script redaction**: changes what is returned to the client (e.g. strip PII, delete images).
- **Log-body masking**: changes the **log body stored in the database**, without affecting what is returned to the client.
The two are independent; to redact secrets in the log body you must do it at the log-body masking layer — don't expect the response script to change log storage.
:::

- Response-script redaction: see the PII redaction section of [Response redaction with scripts](/en/howto/script-response-redact.md).
- Log-body masking fields: see [Log and log-body storage](/en/reference/logs-and-body-storage.md).

## Login and permission audit

- Console account (admin / monitor) permissions: see [Console login and roles](/en/console/login-and-roles.md).
- Login anti-brute-force: consecutive login failures reaching a threshold auto-bans that IP temporarily (default 5 failures ban for 300 seconds).
- Sessions slide-renew every 24 hours; after an admin resets a password, disables, or deletes an account, related sessions are revoked and the other party's login page shows the reason (`password_changed` / `disabled_by_admin`).
- SSO enterprise login (authenticating people who call the gateway via an IdP): see [Configure SSO enterprise login](/en/howto/configure-sso.md).
- Upstream SSO credentials (logging into upstreams like Kiro to obtain refresh credentials, in the opposite direction): see [Upstream SSO login](/en/howto/upstream-sso-login.md).

## Retention period and deletion

- `log_retention_days` controls the log retention days. Lower it to speed up cleanup; raise it to extend the traceability window.
- `logging.max_body_size_mb` limits the capture size of each body — set it to 0 to skip body capture (but you lose content-retention ability; weigh against compliance needs).
- Streaming body disk usage is controlled by `stream_body_max_disk_mb`.

See [Log and log-body storage](/en/reference/logs-and-body-storage.md) for field semantics.

## FAQ

**Q: How do I keep call auditing without capturing bodies?**
Keep request metadata (model, status code, latency, tokens, key name/group) without capturing bodies: set `max_body_size_mb` to 0. Logs still have call records, just no request/response body content.

**Q: Where do I view the audit log?**
The two are different: configuration-change and security-event audit is in Console → **Settings → Audit** (admin only), see [Audit and security configuration](/en/reference/audit-and-security-config.md); the per-API-call request logs are in Console → logs viewer, filterable by time/model/status code/key, or locate precisely by `z-request-id`, and in multi-instance the Live SSE aggregates logs from all instances.

**Q: If the redaction script fails, will the original content leak?**
It depends on `script_error_mode`: with `log-and-continue` (default), a script failure passes the original content through; for strict compliance, set it to `log-and-reject`, which rejects the request outright when the script fails. See [Script API reference](/en/reference/scripting-api.md).

**Next**: [Troubleshoot from symptoms](/en/usecases/troubleshooting.md) for troubleshooting; [Audit and security configuration](/en/reference/audit-and-security-config.md) for fields; [Access control design](/en/practices/access-control.md) for design.