Activity log governance and compliance

Activity > Governance in the dashboard, and /v1/projects/{prj}/activity/... in the API (OpenAPI is generated from code).

Search window (R19)

The dashboard, the hosted viewer, the API and exports read the same store over the same window. An event stays searchable from ingest until its retention expires. Nothing is shown in one surface and missing from another. Events older than the hot window (WT_ACTIVITY_PG_HOT_DAYS, when WT_ACTIVITY_CH=1) are served from ClickHouse. Cold archives are searchable after a restore; GET .../tiers shows the restore ETA.

Timestamps (C24, NIST AU-8)

Timestamps are stored and returned in UTC as RFC 3339 with microsecond precision. received_at comes from the server clock (NTP-synchronised). occurred_at is the sender's.

Retention

• Presets (GET/PUT .../governance): PCI DSS (365 days, 90 online), SOC 2 (365/90), HIPAA (6 years), EU AI Act (at least 6 months), SEC 17a-4 and FINRA (6 years, 2 online), CJIS, FedRAMP. A preset sets a floor: retention below it is refused.

• Retention lock (POST .../retention-lock, org owners, confirm with the project id): write-once. Until it expires:

  • retention cannot drop below its days;

  • the lock can be extended but not shortened or removed;

  • events, archives, the BYOK key and the project cannot be deleted.

  Every lock change issues an Ed25519-signed certificate (.../retention-lock/certificates). With WT_ACTIVITY_OBJECT_LOCK=compliance and an S3 artifact store with Object Lock enabled, cold archives also get S3 Object Lock retention up to the lock date. Without that setting, S3 Object Lock is off, and the API and UI say so.

• Class policies (.../retention-policies): keep matching actions longer, or minimise them sooner, than the project retention. The longest matching policy wins. Minimised events keep verifying (only committed fields are erased). This is chained as wt.activity.retention_minimised.

• ClickHouse copy: it is pruned by the janitor with the same effective retention: the lock floor, the longest class policy and holds. A WORM lock therefore covers every copy.

• Tombstones: every pruned chain range gets a tombstone in the same transaction. The tombstone is signed later, and verifiers report VALID_PRUNED. Its policy names the rules that decided the cut: retention:Nd, lock:Nd, class_policy_cap, hot_window.

Controls

• Dual control (.../approvals): when on, a second member must approve these operations within 24 hours: shortening retention, releasing a hold, revoking the key, deleting an event, deleting a policy. The database enforces this on every path.

• Config changes: every activity.* audit event is chained in the project's _project account as wt.activity.config_changed.

• Reviews and findings (.../reviews, .../findings): log reviews are signed off with a chain re-verification. With a cadence set, an overdue review emails the org admins.

• Watchdog and incidents (.../watchdog, .../incidents): incidents are opened and closed automatically for:

  • a silent source (heartbeat);

  • an ingest error rate over the threshold;

  • a broken stream;

  • a failed verification run.

  People can also record outages and their root causes. Incidents are chained as wt.activity.logging_incident and shown as logging gaps.

• Restore tests (.../restore-tests): once a month one random cold archive is restored and checked (SHA-256, rows, seq continuity).

Evidence and exports

Every file is a gzip tar with FILES.ndjson and a signed MANIFEST.json, kept for 7 days. These jobs need an artifact store (WT_ARTIFACT_STORE); without one they answer 503.

• Evidence bundle (POST .../evidence-bundles) for a period. It holds:

  • per-account chain files, with completeness and gaps, signed checkpoints and tombstones;

  • the configuration snapshot;

  • reviews, findings, incidents and restore tests;

  • the control mapping.

• Subject access export (POST .../actors/{id}/access-export, GDPR Art. 15). The actor id is removed from the job record once the file is built.

• File sizes: evidence, DSAR, portability and timeline files are streamed to the artifact store with no event or account cap, and they include events served from ClickHouse. DSAR and portability files also include the subject's or account's events that only the cold archive still holds; evidence and timeline list the archives.

• Portability export (POST .../portability-export): every retained event, configuration, schemas, the archive index, public keys and sub-processors (WT_ACTIVITY_SUBPROCESSORS, a JSON array).

• Incident timeline (POST .../incident-timeline, NIS2 Art. 23 / DORA Art. 19): events in exact UTC order as JSON, CSV and printable HTML, with the logging incidents of the window. It also gives the deadlines: early warning 24 h, notification 72 h, final report one month after detection.

• Erasure ledger (.../erasure-decisions, .../erasures/{id}/certificate): every granted or refused erasure, with a signed certificate. Erasure is refused while a retention lock is active.

Auditor portal (B9)

• POST .../auditor-grants (org owners) issues a time-boxed link, up to 90 days, for a designated third party: {WT_PUBLIC_URL}/auditor#token=wtaud_.... The token is shown once and stored as SHA-256.

• The portal (/v1/activity/auditor/*) offers:

  • read and search across accounts (or the grant's accounts);

  • re-verification of the chains (stored as evidence);

  • NDJSON or chain export and evidence bundles, after the auditor accepts the undertaking;

  • the control mapping (GET .../controls). It maps PCI DSS 10.x, SOC 2 CC6/CC7, ISO 27001 A.8.15–A.8.17 and A.5.28, NIST AU, HIPAA, GDPR and SEC 17a-4 to evidence from live configuration, verification runs and review sign-offs.

• Every auditor action is chained as wt.activity.auditor_access.

Delivery and export are at-least-once; a retried chained event keeps its idempotency key and is stored once.