The auditors are already writing the questions.

A bundle your auditor can check without trusting us.

Pick a date range of up to 92 days and FleetWarrant builds a bundle: every Event as JSON Lines, a summary CSV, and a manifest listing the SHA-256 of every file, signed with a FleetWarrant-owned KMS key. The bundle carries the public key and a standalone verify.py.

• verify.py needs Python and the cryptography package, nothing else. openssl works too.
• Check the key fingerprint against the one FleetWarrant gives you over a separate channel, not the bundle, so a re-signed bundle fails.
• If signing fails, the export fails. An unsigned bundle is never delivered.
• Every export is itself recorded as an Event, with who made it.
• Raw bodies are in a bundle only if an admin asks for them, and only exist for a Tenant that turned on raw capture. The bundle says it holds unredacted data, and lists a body that was shredded or never captured as unavailable.

Keep what the regulator needs. Freeze what counsel needs.

Each Tenant sets three retention periods: how long Events stay in the dashboard, how long each archive object stays locked, and, for a Tenant that turns on raw capture, how long raw call bodies stay readable. Admins change them within plan limits, and every change is recorded with who made it.

• A legal hold covers a date range, or one Agent, and carries a reason and a case reference.
• Held records don't expire, and their archive objects get an S3 Object Lock legal hold.
• Only an admin places or releases a hold. Both are recorded as Events.
• A hold never shows as released while any record is still frozen by it.

Written once. Deletion is blocked, not impossible.

Every Event is written to an S3 archive under Object Lock before its dashboard record exists. Each object is locked for 1 year by default, and a Tenant can change that within its plan's limits. The bucket denies deletes and has no lifecycle rules, so nothing expires an object out of it, and FleetWarrant's application never deletes one. Object Lock runs in GOVERNANCE mode, which an AWS principal holding s3:BypassGovernanceRetention can bypass. Treat the archive as deletion-resistant, not tamper-proof.

• Each object's SHA-256 and lock date are kept on its Event.
• Archive retention is a minimum lock, not a deletion date.
• The archive holds the redacted preview and the call's metadata. It holds the raw request and response only for a Tenant that turned on raw capture.
• No FleetWarrant application role holds the bypass permission. Administrators of the AWS account do, and FleetWarrant shares that account with unrelated workloads.

Raw bodies stay off until you turn them on.

By default FleetWarrant doesn't keep the raw request and response. It stores a redacted preview of each call, encrypted under your Tenant's own key, plus the call's metadata. A Tenant admin can turn on raw capture for their Tenant. While it's on, the full request and response are archived as well, each sealed under its own key, so one body can be shredded without deleting a locked object or touching any other Event.

• The Gateway sees each request and response in the clear in transit, because it has to forward them. Redaction applies to what is kept, not to what passes through.
• The preview is redacted by a fixed ruleset: secrets, US Social Security numbers, email addresses and card numbers. It isn't general PII redaction. With raw capture on, a value the preview removed is still in the encrypted raw body.
• Turning raw capture off stops new raw bodies. It doesn't remove the ones already archived; they stay until they're shredded.
• Shredding runs on request or by your raw-body retention, checked hourly, and a legal hold pauses it. A shredded body is unreadable on every live path at once, and unrecoverable once the 35-day backup window has passed. Shredding destroys the key, not the object.
• The Event survives: it still proves the call happened, and records when the body was destroyed.

The people are on the record too.

What a person does in the dashboard goes into the same audit trail as your Agents' calls: exports, suspensions, emergency stops, retention changes, legal holds and circuit-breaker settings. Each records who did it, their role, what it was done to and the reason they gave.

• Archived and Object-Locked like every other Event.
• Only FleetWarrant's own services write them. An Agent can't record an action in a person's name.
• An export is refused if its record can't be written.

Refusals leave a record.

When the Gateway refuses a call from an authenticated Agent (a model its Connector doesn't allow, a suspended Agent, a disabled Connector), the refusal is recorded as a Blocked Event with a reason code and the model requested. No request body is kept.

• Filter the dashboard to blocked calls only.
• A bad or revoked key gets no Event, so it can't write into your audit trail.
• Recording is best-effort and capped per Agent and reason, so a retry loop leaves a count, not thousands of Events.

Your records, under your key.

Every record is partitioned by Tenant and encrypted under a KMS key created for that Tenant alone. The key's policy lets only named FleetWarrant service roles decrypt, and only with your Tenant's encryption context.

• Archive objects are encrypted one by one under your Tenant's key. The bucket refuses a write without it.
• A dashboard user belongs to exactly one Tenant.
• This is logical isolation on shared infrastructure, not a dedicated AWS account per customer.

Every Event, in your SIEM, as it's written.

Send the audit trail to Splunk HEC, Datadog Logs, a signed HTTPS webhook or your own S3 bucket. Export runs off the Stream of written Events, never in your Agents' request path.

• S3 goes through a role in your account that FleetWarrant assumes with an external ID. No secret of yours is stored.
• Splunk and Datadog tokens and webhook secrets are stored encrypted under your Tenant's key.
• Webhooks are signed with HMAC-SHA256.
• One versioned JSON format, the same record as an evidence bundle. Delivery is at least once; event_id de-duplicates.