{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T07:59:18.009Z",
  "record_id": "VXI-EXT-PROCUREMENT-DATADOG-AUDIT-01-v1",
  "record_kind": "external_reference",
  "title": "Datadog Audit Trail: Enablement, retention and archive are separate",
  "system": "Datadog",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does enabling Datadog Audit Trail guarantee indefinite searchable audit history?",
  "near_questions": [
    "What retention is configured for Datadog Audit Trail?",
    "Is archiving separately enabled?",
    "Which destination receives events?",
    "Can archive uploads be delayed?",
    "Who controls bucket retention?",
    "What happens to retention when Audit Trail is disabled?",
    "Does a current event prove historic coverage?",
    "Which product actions are audited?",
    "Was archive delivery actually observed?",
    "Does storage existence prove searchable history?",
    "When should an agent avoid promising indefinite evidence?",
    "Can I save the audit-retention review?"
  ],
  "supported_claims": [
    {
      "claim": "The guide provides configurable retention and a separate optional archive path. Archive upload has an interval and setup delay; it is not immediate evidence that every event is retained in the buyer's bucket. Enablement, retention and verified archive delivery need distinct checks.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The guide provides configurable retention and a separate optional archive path. Archive upload has an interval and setup delay; it is not immediate evidence that every event is retained in the buyer's bucket. Enablement, retention and verified archive delivery need distinct checks.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Datadog Audit Trail",
    "source_url": "https://docs.datadoghq.com/account_management/audit_trail/",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-DATADOG-AUDIT-01-v1",
    "candidate_record_sha256": "bd41ab47d4f465acde70654617e5e7f79c0f02b2a7a5bb9cb71d4b71741512f5",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The guide provides configurable retention and a separate optional archive path. Archive upload has an interval and setup delay; it is not immediate evidence that every event is retained in the buyer's bucket. Enablement, retention and verified archive delivery need distinct checks.",
    "required_buyer_context": "Enablement, retention, archive configuration and delivery evidence. Effective buyer configuration and dated operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Enabled Audit Trail guarantees permanent searchable history.",
    "documented_statement": {
      "status": "documented",
      "statement": "The guide provides configurable retention and a separate optional archive path. Archive upload has an interval and setup delay; it is not immediate evidence that every event is retained in the buyer's bucket. Enablement, retention and verified archive delivery need distinct checks.",
      "source_ids": [
        "datadog-audit"
      ]
    },
    "buyer_evidence_required": [
      "Audit Trail enablement and retention selection.",
      "Archive destination and permissions.",
      "Observed archive delivery and downstream retention."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require retained-event evidence for the required review period."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "datadog-audit",
        "url": "https://docs.datadoghq.com/account_management/audit_trail/",
        "final_url": "https://docs.datadoghq.com/account_management/audit_trail/",
        "title": "Datadog Audit Trail",
        "checked_on": "2026-10-16",
        "sha256": "e3d4cc572376a831f69f4cc3338b85ec970a71c61128935c750ac9ee3862c0dd",
        "bytes": 800042
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Save the retention and export assumptions behind an audit-evidence requirement.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Enablement, retention, archive configuration and delivery evidence"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#datadog-audit-retention-archive-separation",
  "machine_readable_record": "/varexis-index/records/datadog-audit-retention-archive-separation.json"
}