Redact Tenant Data in Logs
Define which tenant fields may enter shared logs and how to verify redaction.
Logs are useful evidence, but they often outlive the request that produced them and reach people who cannot see the underlying tenant record. A handler may deny an API response while logging the full object or authorization header. Review log fields as a separate data boundary. The OWASP Logging Cheat Sheet calls for useful events without recording sensitive values.
Make a field allowlist
Choose one security-relevant event, such as a denied record read. Record which fields are necessary to investigate it and which must be omitted or transformed.
| Field | Decision | Reason |
|---|---|---|
| Event type and time | Keep | Supports timeline |
| Actor ID and tenant ID | Keep or pseudonymize | Links decision to owner |
| Resource class and opaque ID | Keep if needed | Identifies affected path |
| Full record body | Omit | Not needed for access decision |
| Token, cookie, or signature | Omit | Credential exposure |
| Denial reason code | Keep | Supports policy review |
A hash is not automatically safe. Low-entropy identifiers or predictable email addresses can be guessed. Decide whether a stable pseudonym is needed and who may reverse it. Keep request bodies out of generic error logging unless a reviewed redaction path exists.
Use synthetic tenant markers in staging. Trigger permitted and denied operations, then inspect application logs, tracing, error monitoring, and warehouse exports. Search for the marker, token-shaped values, and file content. Verify that the event still tells a reviewer which rule was applied and which build emitted it. Redaction that removes all decision context defeats the purpose of the log.
Check downstream sinks
Illustrative safe event: {event:"record_read_denied", actorId:"U1", tenantId:"A", resourceClass:"record", reason:"owner_mismatch", requestId:"R7"}. Send a fixture whose private body contains marker SECRET-B7. Search app logs, proxy traces, error monitoring, and warehouse exports for SECRET-B7 and the Authorization header; require no match. Require the bounded event fields above so redaction does not erase the decision trail.
OWASP Multi Tenant Security makes clear that shared infrastructure needs boundaries. The artifact is a log-field allowlist tied to a real event schema. Revisit it when a new tracing SDK or analytics sink is added. If a sink's retention or access policy is unknown, do not claim tenant data is contained. Keep this check within systems you own or are authorized to review.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.
Sources
- OWASP Logging Cheat SheetAccessed
- OWASP Multi Tenant Security Cheat SheetAccessed