---
title: "Export Audit Evidence"
url: "https://docs.caracal.run/v1.0/operations/compliance-audit-integration/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/operations/compliance-audit-integration.md"
description: "Operate and verify audit ingestion and optional S3-compatible export without claiming compliance."
page_type: "workflow"
concepts: []
requires: []
---

# Export Audit Evidence

Canonical URL: https://docs.caracal.run/v1.0/operations/compliance-audit-integration/
Markdown URL: https://docs.caracal.run/markdown/v1.0/operations/compliance-audit-integration.md
Description: Operate and verify audit ingestion and optional S3-compatible export without claiming compliance.
Page type: workflow
Concepts: none
Requires: none

---

Audit records are technical evidence, not certification or a complete organizational trail. Audit consumes Redis, writes append-only Postgres rows, checks tamper state, and can export complete hourly Parquet partitions.

## Prerequisites

Define evidence scope, retention, access, encryption, legal hold, and archive ownership. Configure `AUDIT_EXPORT_S3_*` only when needed and size `AUDIT_EXPORT_TMP_DIR` for the largest hourly partition.

## Procedure

1. Verify Audit readiness, HMAC, stream group, DLQ, and tamper metrics.
2. Configure an operator-owned S3-compatible endpoint and least-privilege credentials.
3. Enable export; monitor watermark, scratch space, upload failures, and objects.
4. Correlate a canary request across producer, stream, Postgres, and export.
5. Retain applicable HMAC material with verification evidence.

The watermark advances only after successful upload.

## Verify and Recover

Compare counts for a closed interval, inspect DLQ/lag, and verify intended reader access. On failure preserve Postgres, pending entries, DLQ, replay, scratch output, and logs before replay or deletion.

## Next Step

Generate an [Generate an Evidence Pack](/v1.0/security/evidence-pack/) or complete [Hand Off to Platform Teams](/v1.0/operations/platform-team-handoff/).