Runink FACE · Compliance and audit records
This is a scenario for Runink FACE. The checks described here read FACE's own records of your shipments and reports, and they are part of FACE itself.
In Short
- Personal details do not reach the logs. Email addresses, phone numbers, card numbers, national insurance numbers and IP addresses are stripped out of log and diagnostic output before it is written, so the trail a system leaves behind does not become a second copy of the data.
- It is built into the platform, not a report you run. The stripping happens on the logging path underneath every service, at every place a service writes a line.
- Every check keeps its own working. What was read, the rule it was read against, what was found and who looked at it are kept on the record, and a check that could not run is written down as exactly that.
A Trail Nobody Has Time To Check.
Personal details travel with every record, and every system that handles a record leaves a trail behind it. Answering for that trail means joining systems by hand.
Where It Goes Wrong
A customer's name and address are needed to deliver the parcel. They are not needed on a carrier's dashboard, in a report sent to a partner, or in the copy of the file somebody pulled for a meeting. But the field travels with the record, and it keeps going.
Nobody plans this. It happens because the shortest way to answer a question is to export what you have, and what you have has the personal details still in it.
You cannot protect what you cannot see leaving.
Who This Is For
Three desks, and the same question underneath: can you show your working.
- The data protection officer, and compliance and risk. What lands today is a customer's name and address that were needed once to deliver a parcel and have been travelling with the record ever since — into an export, a partner report, a log file nobody reads until something has gone wrong. What changes is where the trail stops. Personal details are stripped out of log and diagnostic output before it is written, on the path underneath every service rather than in a report somebody remembers to run.
- IT and information security. What lands today is a question you can answer only by counting: which of your services write application logs, and which of those put the output through any redaction at all before it is stored or shipped. What changes is that the answer is a property of how the software is built, described in ordinary sentences you can hold a code review against, so the security conversation is a description rather than a negotiation.
- Internal audit, and whoever answers for the report. What lands today is a request to explain why a figure is what it is, months after the person who assembled it moved on. What changes is that the record keeps its own working, and that a check which could not run is written down as its own entry rather than passing quietly as a clean result.
What Happens Instead
Every service writes its logs and diagnostics through a shared redaction step that strips email addresses, phone numbers, card numbers, national insurance numbers, IP and hardware addresses out of the text before it lands, along with named fields — passwords, tokens, secrets, licence keys, webhook URLs — wherever they appear in a structured payload. The point is that operating a system does not quietly create a second copy of the personal data inside it — the place breaches are found late, and the place nobody thinks to look.
Every check keeps a record of its own working. When an auditor asks why a finding is what it is, or when a regulator asks who saw a customer's address, the answer comes from the record instead of from the memory of whoever built the spreadsheet.
The record also keeps apart the two answers people usually run together. “We checked this and found nothing” and “we could not read this, so it was never checked” are written down as different things. The second one is the finding an audit is actually looking for, and it is the one a green tick normally swallows.
How You Will Know It Worked
Every figure below is yours, not ours. Write down where you stand today, because the baseline is gone for good the moment things improve.
- Where personal details actually sit. Take a sample of the reports and screens your partners and carriers see. Count how many carry a name, a phone number or an address. Most teams have never counted this.
- How much of your own log estate is redacted at all. Count the services that write application logs, then count the ones whose output goes through any redaction step before it is stored or shipped to a log provider. This is the baseline the privacy half of this page speaks to, and it is the one most teams can answer in an afternoon and would rather not.
Bring a sample of partner-facing screens and the list of services that write logs.
The exposures above are drawn to show the shape of the work. They are not accounts of a customer engagement, and nothing on this page is a measured result.
The software finds the record, shows the rule it was read against, and hands both to the person who is accountable. Whether you meet an obligation is a judgement that stays with your compliance officer, your DPO and your auditor.
Questions A Compliance Officer Asks First
What the privacy side does, what the record keeps, and who decides.