Audit & Cost
Who, when, which rule.
Every decision produces an event. Events are stored in ECS form and exported to your own SIEM; raw personal data never enters that stream.
- Event types
- 6
- SIEM targets
- 3
- Retries
- 3
- Raw PII
- none
In the product
The record an auditor will read.
The list carries who asked, from which department, through which channel, and with what outcome. Opening one row shows the nine steps of the chain and the rule each masking matched. Both frames are the real interface.
Events
What gets written.
Every blocked request and every returned answer is recorded; stage timings and cost travel on the answer event.
| event | |
|---|---|
prompt_shield_blocked | The jailbreak/injection threshold was crossed. |
prompt_shield_repeat_blocked | A cross-turn repetition attempt was caught. |
policy_blocked | An organisation policy stopped the request. |
rag_pii_masked | PII in retrieved knowledge-base content was masked. |
verification_blocked | Answer verification withheld the response. |
outbound_returned | The answer returned to the user, with stage timings and cost. |
Export
Into your SIEM.
Events are sent in batches; if the target is unreachable, delivery is retried with increasing backoff.
Splunk HEC
sourcetype: "trustlayer:audit"
Elastic Bulk
application/x-ndjson
Webhook
application/json
retry 3x: 1s · 2s · 4s
What never enters the log
What the audit log records is the event: which rule fired, which category, which score. The raw form of a masked value never enters that stream; the log must not become a second way to leak.
Evidence pack
One file you can hand an auditor.
Instead of walking someone through the log line by line, an evidence pack is generated for a date range. The report comes out as PDF or CSV.
You pick the date range; the report covers only records inside it.
If the range holds no records, no empty file is produced — a clear message comes back instead. An empty PDF is the worst thing to hand an auditor as evidence.
The report carries no raw personal data — only counts and decisions. An evidence pack must not create the problem it is evidencing.
Generating the report is itself an audit event: who took it, when, and for which range.
Only the admin role may call the endpoint.
- Endpoint
- GET /v1/audit/compliance-report
- Format
- PDF · CSV
- Required role
- admin
See it with your own data.
In a technical session we run your prompts and your policy through it live.