Concepts

ScaiLog is GDPR-native central logging: a structured logging system where personal information (PI) is a first-class, field-level concept, encryption and erasure are built in, and every log line is traceable back to the exact call site that produced it. These concept pages explain the model behind the product so the day-to-day API and CLI make sense. Read them in any order; each is self-contained.

• Architecture — the components (SDK, agent, server, CLI, scailog-ci, audit), how a log entry flows from emit to the SQLite store, the standalone one-binary mode, and the design invariants.
• Personal information & call-site provenance — how you mark a field as PI with pi(), the PI taxonomy, why the free-text message must stay PI-free, and the developer-assigned call_site_id.
• Encryption & cryptographic erasure — the KRoot → tenant KEK → per-subject DEK key hierarchy, AES-256-GCM field encryption, and Article 17 erasure by destroying a key.
• The policy engine — declarative YAML that decides, per PI field, whether to encrypt, redact, drop, or keep it, resolved most-specific-wins and versioned forever.
• SLWP wire protocol — the local NDJSON socket frames, the zstd-compressed batch codec from agent to server, and the canonical batch checksum.