Audit Logging

Executive Summary

With configurable event filtering (DDL, DML, SELECT, transactions), 7-year retention support, and queryable SQL audit tables, HeliosDB Lite provides complete visibility into data access and modifications while maintaining zero-external-dependency architecture.

Problem Being Solved

Core Problem Statement

Organizations deploying applications to edge devices, microservices, or embedded environments must satisfy regulatory compliance requirements (SOC2, HIPAA, GDPR) that mandate comprehensive audit trails of all data access and modifications, but existing solutions require complex external log aggregation infrastructure incompatible with lightweight, offline-first, or resource-constrained deployments. Teams need tamper-proof audit logging that operates within the database itself without network dependencies, while maintaining performance and storage efficiency critical for embedded systems.

Who Suffers Most

• Industrial IoT Operators: Running critical infrastructure monitoring (power grids, water treatment, manufacturing) on edge compute nodes that require audit trails for safety investigations and regulatory compliance (FDA 21 CFR Part 11, ISO 27001), but cannot tolerate external logging dependencies that create single points of failure.

HeliosDB Lite Solution

Architecture Overview

┌─────────────────────────────────────────────────────────────────────┐
│                 HeliosDB-Lite Audit Logging Stack                   │
├─────────────────────────────────────────────────────────────────────┤
│  SQL Layer: SELECT * FROM __audit_log WHERE operation='INSERT'      │
├─────────────────────────────────────────────────────────────────────┤
│  Audit Query Interface  │  Event Filtering  │  Compliance Presets   │
├─────────────────────────────────────────────────────────────────────┤
│  Async Buffer (Lock-Free Queue)  │  SHA-256 Checksum Chain          │
├─────────────────────────────────────────────────────────────────────┤
│  Append-Only Audit Table (__audit_log)  │  Indexed Metadata Columns │
├─────────────────────────────────────────────────────────────────────┤
│  WAL-Backed Storage (RocksDB LSM) │ Tamper Detection │ Retention Mgmt│
└─────────────────────────────────────────────────────────────────────┘

Concrete Examples with Code, Config & Architecture

Example 1: SOC2 Compliance for Multi-Tenant SaaS - Embedded Configuration

Architecture:

User Request (API)
    ↓
Microservice (Rust + Axum)
    ↓
HeliosDB-Lite (Embedded, In-Process)
    ↓
Async Audit Buffer → Tamper-Proof __audit_log Table
    ↓
Daily Export Job → S3 Archival (7-year retention)

Configuration (heliosdb.toml):

# HeliosDB-Lite configuration for SOC2 audit compliance
[database]
path = "/var/lib/heliosdb/saas_app.db"
memory_limit_mb = 512
enable_wal = true
page_size = 4096

[audit]
# SOC2 requires tracking: who, what, when, result
enabled = true
log_ddl = true                  # Track schema changes
log_dml = true                  # Track data modifications
log_select = false              # Too verbose for most SaaS apps
log_transactions = false        # Optional, increases volume
log_auth = true                 # Track authentication events
retention_days = 90             # SOC2 minimum retention
async_buffer_size = 500         # Balance throughput and memory
enable_checksums = true         # Tamper detection required
max_query_length = 5000         # Truncate long queries to save space

[audit.capture_metadata]
capture_client_ip = true        # Track request origin
capture_application_name = true # Identify microservice
capture_database_name = true    # Multi-tenant isolation
capture_execution_time = true   # Performance monitoring
capture_custom_fields = true    # Tenant ID, correlation ID

[monitoring]
metrics_enabled = true
verbose_logging = false

Example 2: HIPAA Compliance for Healthcare App - Edge Device Deployment

Scenario: Telehealth mobile app for remote patient monitoring deployed to 10,000 iOS/Android devices, each collecting vital signs (heart rate, blood pressure, glucose) and synchronizing to cloud when online. HIPAA requires 7-year audit retention of all PHI access and modifications, tamper-proof logs, and ability to produce audit reports during compliance reviews. Devices operate offline for hours/days.

Edge Device Architecture:

┌───────────────────────────────────────────────────┐
│    iOS/Android Mobile App                         │
├───────────────────────────────────────────────────┤
│  Patient Vital Signs Collection                   │
├───────────────────────────────────────────────────┤
│  HeliosDB-Lite (Embedded, SQLite-compatible)      │
│  - PHI Storage (patients, vital_signs)            │
│  - Tamper-Proof Audit Log (__audit_log)           │
│  - SHA-256 Checksum Chain                         │
├───────────────────────────────────────────────────┤
│  Offline Operation (Hours/Days)                   │
├───────────────────────────────────────────────────┤
│  Sync Engine (When Online)                        │
│  - Upload PHI + Audit Logs to Cloud               │
│  - Verify Integrity Before Upload                 │
├───────────────────────────────────────────────────┤
│  Cloud Backend (HIPAA-Compliant Storage)          │
│  - 7-Year Audit Retention                         │
│  - Compliance Reporting                           │
└───────────────────────────────────────────────────┘

Example 3: GDPR Data Processing Records - Microservices Infrastructure

Scenario: European e-commerce platform with 1M users processing personal data (names, addresses, purchase history) across 50 microservices. GDPR Article 30 requires maintaining records of all data processing activities, including deletions (right to erasure), access logs (right to access), and consent tracking. Deploy audit logging in each microservice with centralized compliance reporting.

Docker Deployment (Dockerfile):

FROM rust:1.75 as builder

WORKDIR /app

# Copy source
COPY . .

# Build microservice with HeliosDB-Lite audit logging
RUN cargo build --release --features audit-logging

# Runtime stage
FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/*

COPY --from=builder /app/target/release/ecommerce-service /usr/local/bin/

# Create audit log volume mount
RUN mkdir -p /var/lib/heliosdb/audit

# Expose service port
EXPOSE 8080

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

# Set audit directory as volume for persistence
VOLUME ["/var/lib/heliosdb/audit"]

ENTRYPOINT ["ecommerce-service"]
CMD ["--config", "/etc/heliosdb/config.toml"]

Docker Compose (docker-compose.yml):

version: '3.8'

services:
  # User service with GDPR audit logging
  user-service:
    build:
      context: ./services/user-service
      dockerfile: Dockerfile
    image: ecommerce/user-service:latest
    container_name: user-service

    ports:
      - "8081:8080"

    volumes:
      - ./data/user-service:/var/lib/heliosdb/audit
      - ./config/user-service.toml:/etc/heliosdb/config.toml:ro

    environment:
      RUST_LOG: "info,user_service=debug"
      GDPR_COMPLIANCE_MODE: "true"
      SERVICE_NAME: "user-service"

    restart: unless-stopped

    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 3s
      retries: 3

    networks:
      - ecommerce-network

  # Order service with GDPR audit logging
  order-service:
    build:
      context: ./services/order-service
      dockerfile: Dockerfile
    image: ecommerce/order-service:latest
    container_name: order-service

    ports:
      - "8082:8080"

    volumes:
      - ./data/order-service:/var/lib/heliosdb/audit
      - ./config/order-service.toml:/etc/heliosdb/config.toml:ro

    environment:
      RUST_LOG: "info,order_service=debug"
      GDPR_COMPLIANCE_MODE: "true"
      SERVICE_NAME: "order-service"

    restart: unless-stopped

    networks:
      - ecommerce-network

  # GDPR compliance reporting service
  compliance-reporter:
    build:
      context: ./services/compliance-reporter
      dockerfile: Dockerfile
    image: ecommerce/compliance-reporter:latest
    container_name: compliance-reporter

    ports:
      - "8090:8080"

    volumes:
      # Mount all service audit logs for aggregation
      - ./data/user-service:/audit/user-service:ro
      - ./data/order-service:/audit/order-service:ro

    environment:
      RUST_LOG: "info"
      AUDIT_SOURCES: "/audit/user-service,/audit/order-service"

    restart: unless-stopped

    networks:
      - ecommerce-network

networks:
  ecommerce-network:
    driver: bridge

volumes:
  user_service_audit:
    driver: local
  order_service_audit:
    driver: local

GDPR Configuration (config/user-service.toml):

[server]
host = "0.0.0.0"
port = 8080
service_name = "user-service"

[database]
path = "/var/lib/heliosdb/audit/user_service.db"
memory_limit_mb = 512
enable_wal = true
page_size = 4096

[audit]
# GDPR Article 30: Records of processing activities
enabled = true
log_ddl = true
log_dml = true
log_select = true   # GDPR: Log all personal data access
log_transactions = false
log_auth = true
retention_days = 2555  # 7 years (typical GDPR retention)
async_buffer_size = 500
enable_checksums = true
max_query_length = 10000

[audit.capture_metadata]
capture_client_ip = true        # Track data subject access origin
capture_application_name = true # Identify processing controller
capture_database_name = true
capture_execution_time = true
capture_custom_fields = true    # User ID, consent ID, purpose

[gdpr]
# GDPR-specific settings
enable_right_to_access = true      # Log all personal data access
enable_right_to_erasure = true     # Track deletion requests
enable_consent_tracking = true     # Log consent changes
data_retention_days = 365          # Auto-delete old user data
audit_retention_days = 2555        # Keep audit trail for 7 years

[container]
enable_shutdown_on_signal = true
graceful_shutdown_timeout_secs = 30

Example 4: Forensic Investigation & Debugging - Production Incident Response

Scenario: Production database corruption incident affecting 5,000 customer records in e-commerce platform. Need to identify root cause (application bug, malicious access, or infrastructure failure), reconstruct sequence of events, and determine data integrity impact. Use audit logs to trace every data modification and identify the problematic operation.

Example 5: Edge Device Audit for Industrial IoT - Offline Operation

Scenario: Industrial manufacturing plant with 100 edge compute nodes controlling production line equipment. Each node runs HeliosDB Lite to store sensor data, control parameters, and process logs. Regulatory compliance (FDA 21 CFR Part 11, ISO 27001) requires complete audit trail of all configuration changes and data modifications, including operator actions, automated system adjustments, and maintenance activities. Devices operate offline for weeks at a time, synchronizing audit logs to central SCADA system during scheduled maintenance windows.

Edge Device Configuration (industrial_device.toml):

[database]
# Ultra-low memory footprint for embedded industrial controller
path = "/var/industrial/control_system.db"
memory_limit_mb = 128
page_size = 512
enable_wal = true
cache_mb = 32

[audit]
# FDA 21 CFR Part 11: Electronic records and signatures
enabled = true
log_ddl = true                  # Track schema/configuration changes
log_dml = true                  # Track all data modifications
log_select = false              # Reduce storage on edge device
log_transactions = true         # Track batch operations
log_auth = true                 # Track operator authentication
retention_days = 2555           # 7 years for FDA compliance
async_buffer_size = 50          # Small buffer for memory-constrained device
enable_checksums = true         # Tamper-proof requirement
max_query_length = 2000         # Truncate for storage efficiency

[audit.capture_metadata]
capture_client_ip = false       # Not applicable for edge device
capture_application_name = true # Identify control software version
capture_database_name = true
capture_execution_time = true
capture_custom_fields = true    # Operator ID, equipment ID, batch number

[edge]
# Offline operation settings
offline_mode = true
sync_on_connect = true
sync_endpoint = "https://scada.factory.local/audit-sync"
compression_enabled = true      # Compress audit logs before sync

[compliance]
regulatory_standard = "FDA_21_CFR_Part_11"
require_electronic_signatures = true
audit_trail_lockdown = true     # Prevent audit log deletion

Adoption Strategy

Phase 1: Proof of Concept (Weeks 1-4)

Target: Validate audit logging in representative production workload

Tactics:

• Enable audit logging in single non-critical microservice or staging environment
• Configure compliance preset (SOC2/HIPAA/GDPR) matching target certification
• Generate sample audit reports demonstrating compliance requirements
• Measure performance impact (latency, memory, storage) on production-like traffic
• Verify tamper-proof guarantees with checksum validation tests

Phase 2: Pilot Deployment (Weeks 5-12)

Tactics:

• Deploy audit logging to 3-5 critical microservices handling sensitive data
• Establish baseline audit log storage requirements (GB/month per service)
• Configure automated compliance reporting pipeline
• Train security/compliance team on audit log querying and analysis
• Document integration patterns for remaining services

Phase 3: Full Rollout (Weeks 13-26)

Target: Organization-wide deployment across all production services/devices

Tactics:

• Gradual rollout to remaining microservices (5-10 services per week)
• Deploy to edge devices and offline-capable applications
• Implement centralized audit log aggregation for compliance reporting
• Integrate with existing SIEM/monitoring tools if needed
• Conduct mock compliance audit to validate completeness

Phase 4: Optimization & Continuous Compliance

Target: Long-term compliance assurance and operational excellence

Tactics:

• Automate quarterly audit log integrity verification (checksum validation)
• Implement audit log analytics for anomaly detection and security monitoring
• Optimize retention policies to balance compliance and storage costs
• Establish runbooks for forensic investigation using audit logs
• Monitor audit log growth trends and adjust configurations

Conclusion

HeliosDB Lite's embedded audit logging feature addresses a critical gap in the lightweight database ecosystem: the absence of compliance and forensic capabilities suitable for resource-constrained, offline-capable deployments. By integrating tamper-proof, cryptographically-verified audit trails directly into the database engine, HeliosDB Lite enables organizations to meet SOC2, HIPAA, and GDPR requirements without the complexity and cost of external log aggregation infrastructure.

Cloud-based audit services introduce network dependencies that violate the core promise of embedded databases.

Call to Action: Organizations preparing for SOC2/HIPAA/GDPR certification should evaluate HeliosDB Lite's audit logging in a 4-week proof-of-concept, focusing on compliance report generation, performance impact measurement, and cost comparison with existing logging infrastructure. The path to regulatory compliance doesn't require sacrificing the simplicity and performance of embedded databases—it requires choosing a database built for the modern compliance landscape.