Event Coverage

LEADaEYE captures audit events across these categories: lead scanning and enrichment, authentication (login, logout, MFA challenges), billing (payment succeeded/failed, entitlement changes), security (IP blocks, rate limit triggers), admin actions (configuration changes, role grants), and GDPR data subject rights requests.

PII Redaction

Email addresses are replaced with [email-redacted] before any log record is written. Only the internal actor ID appears. API tokens and secrets are detected by regex and replaced with [token-redacted]. TOTP codes are never written — only the method type and pass/fail result are recorded. Passwords never appear in any log. Automated regression tests verify PII patterns do not appear in log output.

Retention Periods

• Audit logs: 2 years (default). Configurable per org on Enterprise plans.
• Session records: 30 days after expiry.
• Lead & contact data: 3 years (default). Follows org retention policy.
• Backup files: 30-day rolling cycle.

Append-Only Enforcement

A database-level trigger raises an exception on any DELETE or UPDATE attempt against the audit_logs table, providing tamper evidence.

Accessing Your Audit Logs

Org admins can access their organization's audit trail via the authenticated dashboard. Enterprise customers may request audit log extracts as CSV or JSON for a defined date range, delivered within 10 business days under a signed DPA. Initiate requests via the Legal Request page or contact security@leadaeye.com.