17. Compliance, Audit Log & DSAR
Alex's client asks for proof that their data stays in the EU and a trail of who changed what — and a user emails LexVault asking "what do you have on me?" Both answered without leaving the console.
The Compliance page has three tabs: DPA Report, Audit Log, and Data Export. Together they cover the three things a GDPR auditor (or your customer's legal team) actually asks for: the Article 30 records-of-processing report, the tamper-evident trail of who changed what, and one-click DSAR exports for both the "tell me everything about me" (Article 15) and the "give me my data so I can leave" (Article 20) shapes.
What is a DSAR?
A Data Subject Access Request is the legal mechanism a user or a regulator uses to ask "what personal data do you hold on me?" (Article 15) or "give me my data in a portable format so I can move to a competitor" (Article 20). The controller (you) has a 30-day deadline to comply. Most teams build the export pipeline ad-hoc the first time one lands — Eurobase ships it as a one-click console flow + an API endpoint so you don't write the SQL each time.
DPA Report
Generates a Data Processing Agreement (Article 30) report showing your sub-processors, data flow, encryption status, and whether any CLOUD Act exposure exists. Download it as JSON for your compliance records.
Audit Log
Every sensitive action on your project is automatically recorded in the audit log with a timestamp, actor email, IP address, and metadata. Tracked actions include:
- Auth config changes — updating login providers, OAuth settings, session duration
- API key regeneration — who rotated keys and when
- Project deletion — logged before the data is removed
- Schema DDL — creating, dropping, or renaming tables and columns
- RLS policy changes — toggling row-level security, applying presets, creating or dropping policies
- Index changes — creating or dropping indexes and constraints
- OAuth secrets — setting or rotating provider client secrets (the secret itself is never logged, only the event)
Filtering
Use the action filter dropdown to narrow the log to a specific action type — for example, show only schema.drop_table events to trace who deleted a table and when.
Audit log entries cannot be edited or deleted. They are append-only and stored in the platform database, separate from your project's tenant schema.
Data Export — one-click DSAR
The Data Export tab handles both DSAR shapes regulators and end-users actually ask for: Article 15 (single user, "tell me everything you have on me") and Article 20 (full project, "give me the data so I can leave"). Both run in the background and produce a downloadable zip; the download link expires after 7 days, and all the bytes stay on EU infrastructure (Scaleway fr-par) the whole way. Nothing to wire up, no SQL to write — the deadline is statutory, the tooling shouldn't be the bottleneck.
Full Project Export — Article 20 (data portability)
Exports every row of every table in your tenant schema, plus the auth user records, storage object manifest, and audit log, as a single zip. Pick JSON for round-trippable structure or CSV for spreadsheets. Use this when a customer hands you "we're leaving, give us our data" or when a regulator asks for a full snapshot.
Single-User Export — Article 15 (subject access request)
Search by email or paste a user UUID; the export contains only that user's auth record and every row in your tenant tables that references their user_id. Rate-limited to one export per data subject per 24 hours (so any admin calling for that user is gated by the same window) — this stops a runaway script or a hostile actor with a leaked admin token from exfiltrating the user table one row at a time.
What the audit log records
Every export request, completion, and failure is recorded in the Audit Log with the actor's email + IP. So the trail of who exported what, when, and why is always there for the next compliance review — even after the export bytes themselves expire.