CRM protection audit events
When CRM runs with envelope encryption, Midaz emits Protection Audit Events for encryption-protection activity. These events are persisted per Organization and can be read through the protection-audit endpoint. This mechanism is not available in legacy encryption mode. The audit writer is best-effort: a failed audit emission is logged, but it does not block the CRM operation. Use protection audit events to investigate encryption-protection activity for an Organization. Do not interpret them as a complete record of every Ledger or platform action.
Ledger transaction audit messages
The Ledger publishes transaction audit messages unless
AUDIT_LOG_ENABLED is explicitly set to false. The built-in environment example sets this flag to false. Keep the flag set to false until your downstream consumer, its retention, and its investigation workflows are configured.
These messages are sent to the configured audit queue for downstream storage and processing. Midaz does not expose them as a general queryable Ledger audit-record API; the receiving system owns retention, indexing, and investigation workflows.
Designing your audit trail
Choose the mechanism that matches the data you need to observe:
- Use Protection Audit Events for CRM envelope-encryption activity.
- Enable Ledger transaction audit messages only when your downstream consumer is configured to retain and process them.
- Keep controls, retention, and evidence requirements in the system responsible for the data after Midaz emits it.
For help designing an audit and retention architecture around Midaz, contact us.