---
title: "What are best practices for storing and securing exported log data?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/223a3fe3-4565-40e2-89c8-71200074d887"
language: "en"
last_updated: "2026-04-29T21:42:41.498Z"
---

# What are best practices for storing and securing exported log data?

Storing and securing exported log data is a critical part of maintaining the integrity of your **Spirion Sensitive Data Platform** environment. Because these logs contain administrative actions, technical errors, and potentially sensitive metadata, they must be handled with the same level of care as the data you are scanning.

## 1\. Encryption at Rest and in Transit

-   **In Transit:** Always use **HTTPS (TLS 1.2+)** for API calls. If you are using a script to move logs to a SIEM or a storage bucket (like Amazon S3 or Azure Blob), ensure the transport protocol is encrypted.
-   **At Rest:** If you are storing logs in a local file system or a cloud bucket before ingestion, ensure **AES-256 encryption** is enabled at the storage layer. Never store exported logs in an unencrypted, publicly accessible directory.

## 2\. Implement Strict Access Control (RBAC)

-   **Least Privilege:** Only a small group of security administrators and auditors should have access to the exported log files.
-   **Service Account Security:** The API key or Bearer Token used for the export should be treated as a "Tier 0" credential. Store it in a secure vault (for example, HashiCorp Vault, AWS Secrets Manager) rather than hardcoding it in your export scripts.
-   **Audit the Auditors:** Regularly review the access logs of your storage location to ensure only authorized scripts and users are accessing the exported data.

## 3\. Data Redaction and Minimization

-   **Agent-Side Redaction:** Ensure that Agent-Side Redaction is enabled in your Spirion policies. This ensures that any "match evidence" (snippets of sensitive data) included in the logs is masked *before* it is exported.
-   **Filter at Export:** Use API parameters to export only the log families and severity levels you actually need. This reduces the "attack surface" of your exported data.

## 4\. Retention and Lifecycle Management

-   **Define Retention Periods:** Align your log retention with your organization's compliance requirements (for example, 1 year for PCI-DSS, 7 years for HIPAA).
-   **Automated Deletion:** Use lifecycle policies (for example, S3 Lifecycle Rules) to automatically delete or move logs to cheaper, "cold" storage (like Glacier) after a certain period.
-   **Immutable Storage:** For high-compliance environments, consider using **WORM (Write Once, Read Many)** storage to prevent logs from being altered or deleted before their retention period expires.

## 5\. Integrity and Tamper Protection

-   **Hashing:** When your export script saves a log file, generate a **SHA-256 hash** of the file and store it in a separate, secure location. This allows you to prove later that the logs have not been tampered with.
-   **Digital Signatures:** If your SIEM supports it, digitally sign the log batches before ingestion to ensure authenticity.

## 6\. Monitoring and Alerting

-   **Export Failure Alerts:** Set up an alert in your monitoring system (for example, Nagios, Zabbix, or cloud-native tools) to trigger if your export script fails to run or returns an error. A gap in your logs is a major compliance risk.
-   **Unauthorized Access Alerts:** Alert on any successful login to your log storage location that does not originate from your known export service account IP address.

## Summary Checklist for Secure Storage

1.  **Encrypt:** Use TLS for transit and AES-256 for rest.
2.  **Vault:** Store API tokens in a secure secret manager.
3.  **Redact:** Mask sensitive snippets at the agent level.
4.  **Retain:** Set automated lifecycle and deletion rules.
5.  **Verify:** Use hashes to ensure log integrity.

By following these best practices, you ensure that your Spirion logs remain a trustworthy "System of Record" that supports your security and compliance goals without introducing new risks to your organization.