44.2 Logging policies: what to store and redact

What to Log

Redaction

// logging.ts
interface AILog {
  requestId: string;
  timestamp: Date;
  userIdHash: string;  // Hashed, not raw
  prompt: string;      // Redacted
  response: string;    // Redacted
  latencyMs: number;
  model: string;
  tokensUsed: number;
}

function createLog(request: AIRequest, response: AIResponse): AILog {
  return {
    requestId: request.id,
    timestamp: new Date(),
    userIdHash: hash(request.userId),
    prompt: redactPII(request.prompt),
    response: redactPII(response.text),
    latencyMs: response.latencyMs,
    model: request.model,
    tokensUsed: response.tokensUsed
  };
}

Retention

// Auto-delete old logs
async function cleanupLogs() {
  const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
  
  await db.logs.deleteMany({
    timestamp: { $lt: thirtyDaysAgo },
    type: { $in: ['prompt', 'response'] }
  });
}

Where to go next

• 44.3 User consent and transparency