Centralized Logging
Collection and retention of application logs, platform logs, signing audit logs, and client activity logs
The SSM.ro platform collects logs from multiple sources, each with a dedicated destination and retention window.
Log Sources and Retention
| Source | Content | Destination | Retention | Model |
|---|---|---|---|---|
| Application logs | Web and worker logs | New Relic | Per New Relic plan | Shared |
| Application logs | Web and worker logs | AWS CloudWatch Logs | Per configuration | Dedicated |
| Runtime exceptions | Application errors (type, message, stack trace) | Sentry | Per Sentry plan | Both |
| Document signing audit | Each signature: signer identity, timestamp, document hash | AWS CloudWatch Logs | 5 years (append-only, encrypted) | Both |
| Client (tenant) activity | Logins, deletions, downloads, operational events | Platform database | 3 months (downloadable by Super User) | Both |
Signing Audit Trail
The electronic signature audit trail is written to AWS CloudWatch Logs, is append-only, encrypted at rest, and restricted via IAM. It is tamper-evident and independent of the application, providing long-term integrity evidence (5 years).
Applicable to both models
The signing audit trail in CloudWatch is used in both models. Additionally, in the Enterprise (Dedicated) Model, application logs are also stored in CloudWatch (not in New Relic).
Client-Accessible Activity Logs
Each tenant's Super User can view and export their organization's activity logs directly from the client panel (3-month retention). Audit evidence regarding user activity is extracted by the client from their own tenant — see Reports Available to Clients.
Role in Intrusion Detection
NRQL alerts in New Relic on application error rates provide application-level intrusion detection signals — a sudden spike in errors may indicate abnormal activity. This is one of the compensating controls in place of a dedicated WAF (see Network Security). Alert configuration: Metrics and Alerts.