CloudWatch Monitoring

AWS CloudWatch Logs — signing audit trail in both models (5 years, append-only, encrypted); application logs in the Enterprise model

Applicability

AWS CloudWatch Logs is used in both deployment models for electronic signature audit logging. In addition, in the Enterprise (Dedicated) model, CloudWatch is also used for application logs (instead of New Relic).

CloudWatch Usage

AWS CloudWatch Logs is primarily used for electronic signature audit logging — in both models. In the Enterprise (Dedicated) model, it also replaces New Relic as the application logging system.

Characteristics

Parameter	Configuration
Content	Signing audit events: signer identity, timestamp, document hash, key used
Retention	5 years (regulatory requirement for electronic signatures)
Integrity	Append-only — logs cannot be modified retroactively
Encryption	Encryption at rest via AWS managed encryption
Access	IAM-restricted — access limited to authorized AWS identities

Data Flow

Processing component (signing orchestration)
    │ audit event generated on each signing
    │ HTTPS (AWS IAM-scoped credentials)
    ▼
AWS CloudWatch Logs — Log Group (signing audit trail)
    retention: 5 years
    append-only, tamper-evident

Signing Audit Trail — Properties

Tamper-evident: CloudWatch Logs' append-only architecture ensures that once records are written, they cannot be deleted or modified by the application.

Independent: The trail is independent of the application database — even if the database were compromised, the audit trail remains intact.

Long duration: The 5-year retention satisfies regulatory requirements for archiving electronic signatures and the associated audit trail.

Relationship to Other Logging Systems

System	What it logs	Retention	Model
AWS CloudWatch Logs	Signing audit (regulatory) + application logs (Dedicated)	5 years (signing)	Shared + Enterprise
New Relic	Live application logs, APM	Per NR plan	Shared
Sentry	Runtime exceptions	Per Sentry plan	Shared + Enterprise
Heroku Postgres / DB	Customer activity logs (tenant-visible)	3 months	Shared + Enterprise