GDPR: minimise personal data in logs, traces, metrics, alerts and webhook journals

[stephane-segning]

Context

Telemetry and retry infrastructure can become an uncontrolled duplicate store for recipient identifiers and message content. Relevant GDPR principles include Art. 5(1)(c), Art. 25 and Art. 32.

Scope

Audit vsms logging, tracing, metrics, alert payloads, provider error handling, webhook request journals and admin-console diagnostics for MSISDNs, message bodies, OTPs and other personal data.

Establish central redaction/pseudonymisation rules and safe operator identifiers rather than relying on individual call sites.

Acceptance

• Message/OTP plaintext is forbidden from logs, traces, metrics and alerts by default.
• MSISDNs are redacted or pseudonymised wherever the full value is not operationally necessary.
• Provider responses/errors are filtered before logging so upstream payloads cannot bypass redaction.
• Webhook request journals have an explicit privacy retention policy and minimise payload duplication.
• Tests cover representative success, retry and provider-error paths for leakage.
• Correlation remains possible using message/event IDs rather than direct identifiers.
• A central helper, lint/static gate or equivalent mechanism makes unsafe logging harder to introduce.