Skip to main content

Operations, Security & Audit

Guidelines for production administration, database backups, key rotation, and audit logs.

1. API Key Rotation​

Nicolás De Lauretis can rotate ingestion credentials at any time:

  1. Issue a POST /v1/finances/api-keys call with a new name and rawKey.
  2. Update GrokBot or Mango with the new key.
  3. Deactivate or delete the previous key in Cloudflare D1: 
    UPDATE api_keys SET active = 0 WHERE id = 'key_old_id';

2. Audit Logging & PII Sanitization​

All incoming requests are logged at the edge without sensitive personal data:

  • Logged: Request UUID, HTTP method, path, response code, execution duration.
  • Sanitized / Redacted:
    • X-API-Key and Authorization headers.
    • Raw JSON request payloads and transaction notes.
    • Sensitive merchant details.

3. Database Maintenance & Backups​

Cloudflare D1 automatically captures point-in-time snapshots.

  • To inspect database status via Cloudflare CLI: 
    npx wrangler d1 info FINANZAS_DB
  • To export a point-in-time snapshot of the database: 
    npx wrangler d1 export FINANZAS_DB --output=backup-$(date +%F).sql

4. Disaster Recovery​

In case of a regional partition or corrupted sync:

  1. Re-run schema initialization: await db.ensureSchema().
  2. Resync from Notion: Since Notion is the operational source of truth, GrokBot can replay the historical ledger with revision counters to rebuild D1 state without data loss.