What Gasket records
And for how long.
- Every action and decision, with rule, policy version and who decided: kept.
- Every event: kept.
- API request log with bodies (up to 16 KB): 90 days.
- API keys: never stored, only their hash.
- Download decisions as CSV from Audit log.