# Audit and personal data

> Shows an auditor what agents did and what protects them, and keeps personal data away from model providers.

Builders work from a coding agent and operators from an AI client, both through the MCP server, or in the Studio. In Mindset, an agent is a prompt and a model, held to an order by a script when needed. It uses connections to outside systems, operations on them, functions and widgets. Every change is a version, and every execution is a run. Every piece sits on one security and compliance layer: the org sets its posture once, and every agent works under it, with the audit trail and, once an admin turns it on, personal data redaction. The platform runs in your own cloud (AWS, GCP or Azure) or is hosted by Mindset. Your app reaches agents through the SDK, your server through the API, and people through the Hub and schedules. Highlighted: Operators, Run.

## Ask your AI client

```
Which admins changed the invoice exceptions agent's connections this month? And is personal data protection on for our org?
```

## What you get back

Each change from the audit trail with who made it, when and through which channel, cited by record. Mindset writes every record the moment something happens, and no agent can skip it. The trail is append only: each record is hash-chained to the one before it, so a change anywhere would show.

Editing a widget, script or function writes no audit record. Their own versions are the record of what changed. An agent's model and tool calls are in **Log**, not here.

> **Info:** The audit record and personal data protection are part of your org's [compliance posture](https://docs.mindset.ai/docs/compliance), set once and applied to every agent.

## Personal data

Personal data protection finds personal data in what an agent sends to a model and swaps each value for a placeholder before the provider sees it. Nothing is blocked.

> **Warning:** It's off until an admin turns it on.

| Policy                                            | What happens                                                                                        |
| ------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| **Off**                                           | Messages reach the provider as written. The default                                                 |
| **Redact permanently**                            | The assistant and every tool it calls see placeholders, so anything that needs the real value fails |
| **Redact, with audited access to the real value** | Restored on the way back, and each restore is recorded                                              |
| **Redact in transit only**                        | Restored straight away on the way back                                                              |

Six built-in classes are on by default: email, phone, card, IBAN, national ID (US SSN) and IP address. Add your own patterns, such as a supplier account number: at most 25 on at once, 200 characters each, and a pattern that runs over 25 ms or can match an empty string is refused. Images are never scrubbed. Audit never shows the real value, at any setting.

An AI model connection has a **PII protection** switch that can only remove protection, and only for calls made through that connection, such as a function's. Agent conversations follow the org policy.

## Evidence for a framework

Obligations maps the trail to the controls of EU AI Act, GDPR, SOC 2, NIST 800-53 AU, ISO 42001, HIPAA and SEC 17a-4. Controls that need a person are attested by an admin, with their name. **Generate pack** exports one JSON file for a framework, covering the whole trail with its chain re-verified. There's no date range to pick, so filter the JSON by `createdAt`.

## What you decide

- The personal data policy, and any patterns of your own.
- How long audit records are kept: 6 months minimum and by default, 120 at most. Past that, placeholders can no longer be resolved to real values. The record itself is never deleted.
- How long conversations are kept, a separate setting in days.

## Done when

- The personal data policy is a choice someone made, not the default left unread.
- You can answer "who changed this agent, and when" from the trail.
- You've generated one evidence pack for the framework your auditor uses.

## In the Studio

**Govern → Audit** has four tabs: **Posture** (one card per protection, and **Re-verify now**), **Personal data** (what was caught, by which rule, and whether it was restored), **Obligations** and **Record**, filtered with chips. The **Audit Agent** on the left answers questions and draws charts. Policies, patterns and retention are set on **Settings → Governance**. Audit is admin only.

![The Posture tab of Audit, one card per protection.](https://docs.mindset.ai/images/docs/studio/audit-posture.png)