---
title: Concepts
path: concepts
status: published
---

# Concepts

ScaiLog is GDPR-native central logging: a structured logging system where
personal information (PI) is a first-class, field-level concept, encryption and
erasure are built in, and every log line is traceable back to the exact call
site that produced it. These concept pages explain the model behind the product
so the day-to-day API and CLI make sense. Read them in any order; each is
self-contained.

- [Architecture](/docs/scailog/concepts/architecture) — the components (SDK,
  agent, server, CLI, `scailog-ci`, audit), how a log entry flows from emit to
  the SQLite store, the standalone one-binary mode, and the design invariants.
- [Personal information & call-site provenance](/docs/scailog/concepts/pi-and-call-sites)
  — how you mark a field as PI with `pi()`, the PI taxonomy, why the free-text
  `message` must stay PI-free, and the developer-assigned `call_site_id`.
- [Encryption & cryptographic erasure](/docs/scailog/concepts/encryption-and-erasure)
  — the KRoot → tenant KEK → per-subject DEK key hierarchy, AES-256-GCM field
  encryption, and Article 17 erasure by destroying a key.
- [The policy engine](/docs/scailog/concepts/policies) — declarative YAML that
  decides, per PI field, whether to encrypt, redact, drop, or keep it, resolved
  most-specific-wins and versioned forever.
- [SLWP wire protocol](/docs/scailog/concepts/wire-protocol) — the local NDJSON
  socket frames, the zstd-compressed batch codec from agent to server, and the
  canonical batch checksum.