From 174b3644a9b0dcc4609b9261ec3782d0e3c08a3a Mon Sep 17 00:00:00 2001
From: Sagnik Ghosh <sagnik@worqhat.com>
Date: Mon, 4 May 2026 10:54:14 +0530
Subject: [PATCH] Implement audit log hardening with retention, export limits,
 and date filtering

Generated-By: PostHog Code
Task-Id: 724f7f1d-c542-4cce-9332-eda23b8b7849
---
 .env.example                                  |   4 +
 app/(dashboard)/settings/audit-log/page.tsx   |  71 +-
 app/api/internal/audit-logs/route.ts          |  84 ++-
 app/api/internal/suppressions/[id]/route.ts   |  13 +-
 app/api/internal/suppressions/route.ts        |   9 +
 .../suppressions/upload/confirm/route.ts      |  14 +
 app/api/v1/suppressions/[id]/route.ts         |  25 +-
 app/api/v1/suppressions/bulk/route.ts         |  57 +-
 app/api/v1/suppressions/route.ts              |  97 +--
 app/api/webhooks/resend/route.ts              |  32 +-
 app/api/webhooks/ses/route.ts                 |  23 +-
 app/unsubscribe/[token]/page.tsx              |  13 +
 .../migrations/0002_audit_log_hardening.sql   |  50 ++
 drizzle/migrations/meta/0002_snapshot.json    | 681 ++++++++++++++++++
 drizzle/migrations/meta/_journal.json         |   9 +-
 lib/audit/index.ts                            |  10 +
 lib/queue/index.ts                            |   3 +-
 lib/suppressions/index.ts                     |   9 +-
 worker.ts                                     |  66 +-
 19 files changed, 1156 insertions(+), 114 deletions(-)
 create mode 100644 drizzle/migrations/0002_audit_log_hardening.sql
 create mode 100644 drizzle/migrations/meta/0002_snapshot.json

diff --git a/.env.example b/.env.example
index 1e7be84..02f867c 100644
--- a/.env.example
+++ b/.env.example
@@ -25,6 +25,10 @@ ENCRYPTION_KEY=            # Generate with: openssl rand -hex 32
 # Worker
 WORKER_CONCURRENCY=5
 
+# Audit log
+AUDIT_LOG_RETENTION_DAYS=365      # Daily purge job deletes entries older than this. Set to 0 to disable.
+AUDIT_LOG_EXPORT_MAX_ROWS=100000  # Cap for CSV exports; tighten the date range if exceeded.
+
 # Webhooks (optional, for bounce/complaint tracking)
 # RESEND_WEBHOOK_SECRET=   # From Resend dashboard
 
diff --git a/app/(dashboard)/settings/audit-log/page.tsx b/app/(dashboard)/settings/audit-log/page.tsx
index 45159e9..9448842 100644
--- a/app/(dashboard)/settings/audit-log/page.tsx
+++ b/app/(dashboard)/settings/audit-log/page.tsx
@@ -48,17 +48,38 @@ export default function AuditLogPage() {
   const [actorType, setActorType] = useState<string>("")
   const [resourceType, setResourceType] = useState<string>("")
   const [actionFilter, setActionFilter] = useState<string>("")
+  const [fromDate, setFromDate] = useState<string>("")
+  const [toDate, setToDate] = useState<string>("")
   const [page, setPage] = useState(1)
 
+  function buildFilterParams(): URLSearchParams {
+    const params = new URLSearchParams()
+    if (actorType) params.set("actorType", actorType)
+    if (resourceType) params.set("resourceType", resourceType)
+    if (actionFilter) params.set("action", actionFilter)
+    if (fromDate) params.set("from", new Date(fromDate).toISOString())
+    if (toDate) {
+      const to = new Date(toDate)
+      to.setHours(23, 59, 59, 999)
+      params.set("to", to.toISOString())
+    }
+    return params
+  }
+
+  function handleExport() {
+    const params = buildFilterParams()
+    params.set("format", "csv")
+    window.location.href = `/api/internal/audit-logs?${params.toString()}`
+  }
+
   useEffect(() => {
     let cancelled = false
     async function fetchLogs() {
       setLoading(true)
       try {
-        const params = new URLSearchParams({ page: String(page), limit: "50" })
-        if (actorType) params.set("actorType", actorType)
-        if (resourceType) params.set("resourceType", resourceType)
-        if (actionFilter) params.set("action", actionFilter)
+        const params = buildFilterParams()
+        params.set("page", String(page))
+        params.set("limit", "50")
         const res = await fetch(`/api/internal/audit-logs?${params.toString()}`)
         if (!res.ok || cancelled) return
         const json = await res.json()
@@ -72,17 +93,23 @@ export default function AuditLogPage() {
     }
     fetchLogs()
     return () => { cancelled = true }
-  }, [page, actorType, resourceType, actionFilter])
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [page, actorType, resourceType, actionFilter, fromDate, toDate])
 
   const totalPages = Math.max(1, Math.ceil(meta.total / meta.limit))
 
   return (
     <div className="space-y-6">
-      <div>
-        <h1 className="text-2xl font-bold font-heading">Audit Log</h1>
-        <p className="text-sm text-muted-foreground mt-1">
-          Append-only record of every state-changing action.
-        </p>
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <h1 className="text-2xl font-bold font-heading">Audit Log</h1>
+          <p className="text-sm text-muted-foreground mt-1">
+            Append-only record of every state-changing action.
+          </p>
+        </div>
+        <Button variant="outline" size="sm" onClick={handleExport} disabled={loading}>
+          Export CSV
+        </Button>
       </div>
 
       <div className="flex flex-wrap items-end gap-3">
@@ -123,7 +150,27 @@ export default function AuditLogPage() {
             className="w-56 h-9"
           />
         </div>
-        {(actorType || resourceType || actionFilter) && (
+        <div className="space-y-1">
+          <Label htmlFor="filter-from" className="text-xs">From</Label>
+          <Input
+            id="filter-from"
+            type="date"
+            value={fromDate}
+            onChange={(e) => { setFromDate(e.target.value); setPage(1) }}
+            className="w-40 h-9"
+          />
+        </div>
+        <div className="space-y-1">
+          <Label htmlFor="filter-to" className="text-xs">To</Label>
+          <Input
+            id="filter-to"
+            type="date"
+            value={toDate}
+            onChange={(e) => { setToDate(e.target.value); setPage(1) }}
+            className="w-40 h-9"
+          />
+        </div>
+        {(actorType || resourceType || actionFilter || fromDate || toDate) && (
           <Button
             variant="ghost"
             size="sm"
@@ -131,6 +178,8 @@ export default function AuditLogPage() {
               setActorType("")
               setResourceType("")
               setActionFilter("")
+              setFromDate("")
+              setToDate("")
               setPage(1)
             }}
           >
diff --git a/app/api/internal/audit-logs/route.ts b/app/api/internal/audit-logs/route.ts
index 50483d0..a636c90 100644
--- a/app/api/internal/audit-logs/route.ts
+++ b/app/api/internal/audit-logs/route.ts
@@ -3,14 +3,10 @@ import { db } from '@/lib/db'
 import { auditLogs } from '@/lib/db/schema'
 import { and, desc, eq, gte, lte, count, SQL } from 'drizzle-orm'
 
-export async function GET(req: NextRequest) {
-  const { searchParams } = req.nextUrl
-
-  const page = Math.max(1, parseInt(searchParams.get('page') ?? '1', 10))
-  const rawLimit = parseInt(searchParams.get('limit') ?? '50', 10)
-  const limit = Math.min(Math.max(1, rawLimit), 200)
-  const offset = (page - 1) * limit
+const DEFAULT_EXPORT_MAX_ROWS = 100_000
 
+function parseFilters(searchParams: URLSearchParams): SQL | undefined {
+  const conditions: SQL[] = []
   const actorType = searchParams.get('actorType')
   const resourceType = searchParams.get('resourceType')
   const resourceId = searchParams.get('resourceId')
@@ -18,7 +14,6 @@ export async function GET(req: NextRequest) {
   const fromStr = searchParams.get('from')
   const toStr = searchParams.get('to')
 
-  const conditions: SQL[] = []
   if (actorType) conditions.push(eq(auditLogs.actorType, actorType))
   if (resourceType) conditions.push(eq(auditLogs.resourceType, resourceType))
   if (resourceId) conditions.push(eq(auditLogs.resourceId, resourceId))
@@ -32,7 +27,78 @@ export async function GET(req: NextRequest) {
     if (!Number.isNaN(to.getTime())) conditions.push(lte(auditLogs.createdAt, to))
   }
 
-  const where = conditions.length > 0 ? and(...conditions) : undefined
+  return conditions.length > 0 ? and(...conditions) : undefined
+}
+
+const CSV_COLUMNS = [
+  'id',
+  'createdAt',
+  'actorType',
+  'actorId',
+  'actorLabel',
+  'action',
+  'resourceType',
+  'resourceId',
+  'ipAddress',
+  'userAgent',
+  'metadata',
+] as const
+
+function csvEscape(value: unknown): string {
+  if (value === null || value === undefined) return ''
+  const str = value instanceof Date ? value.toISOString() : typeof value === 'object' ? JSON.stringify(value) : String(value)
+  if (/[",\n\r]/.test(str)) {
+    return `"${str.replace(/"/g, '""')}"`
+  }
+  return str
+}
+
+export async function GET(req: NextRequest) {
+  const { searchParams } = req.nextUrl
+  const where = parseFilters(searchParams)
+  const format = searchParams.get('format')
+
+  if (format === 'csv') {
+    const exportMax = parseInt(process.env.AUDIT_LOG_EXPORT_MAX_ROWS ?? String(DEFAULT_EXPORT_MAX_ROWS), 10)
+    const cap = Number.isFinite(exportMax) && exportMax > 0 ? exportMax : DEFAULT_EXPORT_MAX_ROWS
+
+    const [{ total }] = await db.select({ total: count() }).from(auditLogs).where(where)
+    if (total > cap) {
+      return NextResponse.json(
+        {
+          error: `Export would return ${total} rows, exceeding the cap of ${cap}. Narrow the date range or filters.`,
+        },
+        { status: 400 },
+      )
+    }
+
+    const rows = await db
+      .select()
+      .from(auditLogs)
+      .where(where)
+      .orderBy(desc(auditLogs.createdAt))
+      .limit(cap)
+
+    const lines: string[] = [CSV_COLUMNS.join(',')]
+    for (const row of rows) {
+      lines.push(CSV_COLUMNS.map((col) => csvEscape((row as Record<string, unknown>)[col])).join(','))
+    }
+    const body = lines.join('\n') + '\n'
+    const filename = `audit-logs-${new Date().toISOString().slice(0, 19).replace(/:/g, '')}.csv`
+
+    return new NextResponse(body, {
+      status: 200,
+      headers: {
+        'Content-Type': 'text/csv; charset=utf-8',
+        'Content-Disposition': `attachment; filename="${filename}"`,
+      },
+    })
+  }
+
+  const page = Math.max(1, parseInt(searchParams.get('page') ?? '1', 10))
+  const rawLimit = parseInt(searchParams.get('limit') ?? '50', 10)
+  const limit = Math.min(Math.max(1, rawLimit), 200)
+  const offset = (page - 1) * limit
 
   const [{ total }] = await db
     .select({ total: count() })
diff --git a/app/api/internal/suppressions/[id]/route.ts b/app/api/internal/suppressions/[id]/route.ts
index 6dbce8b..f84cb39 100644
--- a/app/api/internal/suppressions/[id]/route.ts
+++ b/app/api/internal/suppressions/[id]/route.ts
@@ -1,13 +1,22 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { unsuppressEmailById } from '@/lib/suppressions'
+import { auditFromSession, logAudit } from '@/lib/audit'
 
 export async function DELETE(
-  _req: Request,
+  req: NextRequest,
   { params }: { params: { id: string } }
 ) {
   const removed = await unsuppressEmailById(params.id)
   if (!removed) {
     return NextResponse.json({ error: 'Suppression not found' }, { status: 404 })
   }
+
+  await logAudit(
+    await auditFromSession(req),
+    'suppression.delete',
+    { type: 'suppression', id: params.id },
+    { email: removed.email },
+  )
+
   return NextResponse.json({ success: true })
 }
diff --git a/app/api/internal/suppressions/route.ts b/app/api/internal/suppressions/route.ts
index e8e9dc0..f59d098 100644
--- a/app/api/internal/suppressions/route.ts
+++ b/app/api/internal/suppressions/route.ts
@@ -4,6 +4,7 @@ import { suppressions } from '@/lib/db/schema'
 import { ilike, sql, desc } from 'drizzle-orm'
 import { createSuppressionSchema } from '@/lib/validations/suppressions'
 import { suppressEmail, normalizeEmail } from '@/lib/suppressions'
+import { auditFromSession, logAudit } from '@/lib/audit'
 
 export async function GET(req: NextRequest) {
   const { searchParams } = new URL(req.url)
@@ -53,5 +54,13 @@ export async function POST(req: NextRequest) {
   })
 
   const [row] = await db.select().from(suppressions).where(sql`${suppressions.email} = ${email}`).limit(1)
+
+  await logAudit(
+    await auditFromSession(req),
+    'suppression.create',
+    { type: 'suppression', id: row?.id ?? null },
+    { email, reason: parsed.data.reason ?? 'manual', source: parsed.data.source ?? 'manual' },
+  )
+
   return NextResponse.json(row, { status: 201 })
 }
diff --git a/app/api/internal/suppressions/upload/confirm/route.ts b/app/api/internal/suppressions/upload/confirm/route.ts
index 70345f6..c289ba4 100644
--- a/app/api/internal/suppressions/upload/confirm/route.ts
+++ b/app/api/internal/suppressions/upload/confirm/route.ts
@@ -3,6 +3,7 @@ import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3'
 import * as XLSX from 'xlsx'
 import { uploadConfirmSchema, SUPPRESSION_REASONS } from '@/lib/validations/suppressions'
 import { suppressEmailsBulk, type SuppressInput, type SuppressionReason } from '@/lib/suppressions'
+import { auditFromSession, logAudit } from '@/lib/audit'
 
 const s3 = new S3Client({
   region: process.env.S3_REGION!,
@@ -70,5 +71,18 @@ export async function POST(request: NextRequest) {
   }
 
   const result = await suppressEmailsBulk(inputs)
+
+  await logAudit(
+    await auditFromSession(request),
+    'suppression.bulk_import',
+    { type: 'suppression', id: null },
+    {
+      filename: filename ?? null,
+      submitted: inputs.length,
+      inserted: result.inserted,
+      skipped: result.skipped,
+    },
+  )
+
   return NextResponse.json(result)
 }
diff --git a/app/api/v1/suppressions/[id]/route.ts b/app/api/v1/suppressions/[id]/route.ts
index 06b51f7..7b19873 100644
--- a/app/api/v1/suppressions/[id]/route.ts
+++ b/app/api/v1/suppressions/[id]/route.ts
@@ -1,18 +1,25 @@
 import { NextRequest, NextResponse } from 'next/server'
-import { authenticateApiKey } from '@/lib/api-auth'
+import { withApiAuth } from '@/lib/api-auth'
 import { unsuppressEmailById } from '@/lib/suppressions'
+import { auditFromApiKey, logAudit } from '@/lib/audit'
 
 export async function DELETE(
   req: NextRequest,
   { params }: { params: { id: string } }
 ) {
-  if (!(await authenticateApiKey(req))) {
-    return NextResponse.json({ error: 'Unauthorized', data: null, meta: {} }, { status: 401 })
-  }
+  return withApiAuth(req, async (auth) => {
+    const removed = await unsuppressEmailById(params.id)
+    if (!removed) {
+      return NextResponse.json({ error: 'Suppression not found', data: null, meta: {} }, { status: 404 })
+    }
 
-  const removed = await unsuppressEmailById(params.id)
-  if (!removed) {
-    return NextResponse.json({ error: 'Suppression not found', data: null, meta: {} }, { status: 404 })
-  }
-  return NextResponse.json({ data: { id: params.id, removed: true }, meta: {}, error: null })
+    await logAudit(
+      auditFromApiKey(req, auth),
+      'suppression.delete',
+      { type: 'suppression', id: params.id },
+      { email: removed.email },
+    )
+
+    return NextResponse.json({ data: { id: params.id, removed: true }, meta: {}, error: null })
+  })
 }
diff --git a/app/api/v1/suppressions/bulk/route.ts b/app/api/v1/suppressions/bulk/route.ts
index ef6e57b..69e3ee5 100644
--- a/app/api/v1/suppressions/bulk/route.ts
+++ b/app/api/v1/suppressions/bulk/route.ts
@@ -1,35 +1,42 @@
 import { NextRequest, NextResponse } from 'next/server'
-import { authenticateApiKey } from '@/lib/api-auth'
+import { withApiAuth } from '@/lib/api-auth'
 import { bulkSuppressionsSchema } from '@/lib/validations/suppressions'
 import { suppressEmailsBulk, type SuppressInput } from '@/lib/suppressions'
+import { auditFromApiKey, logAudit } from '@/lib/audit'
 
 export async function POST(req: NextRequest) {
-  if (!(await authenticateApiKey(req))) {
-    return NextResponse.json({ error: 'Unauthorized', data: null, meta: {} }, { status: 401 })
-  }
+  return withApiAuth(req, async (auth) => {
+    let body: unknown
+    try {
+      body = await req.json()
+    } catch {
+      return NextResponse.json({ error: 'Invalid JSON body', data: null, meta: {} }, { status: 400 })
+    }
 
-  let body: unknown
-  try {
-    body = await req.json()
-  } catch {
-    return NextResponse.json({ error: 'Invalid JSON body', data: null, meta: {} }, { status: 400 })
-  }
+    const parsed = bulkSuppressionsSchema.safeParse(body)
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validation failed', data: null, meta: { details: parsed.error.flatten() } },
+        { status: 400 }
+      )
+    }
 
-  const parsed = bulkSuppressionsSchema.safeParse(body)
-  if (!parsed.success) {
-    return NextResponse.json(
-      { error: 'Validation failed', data: null, meta: { details: parsed.error.flatten() } },
-      { status: 400 }
-    )
-  }
+    const inputs: SuppressInput[] = parsed.data.emails.map((entry) => ({
+      email: entry.email,
+      reason: entry.reason ?? 'manual',
+      source: entry.source ?? 'api-bulk',
+      metadata: entry.metadata,
+    }))
+
+    const result = await suppressEmailsBulk(inputs)
 
-  const inputs: SuppressInput[] = parsed.data.emails.map((entry) => ({
-    email: entry.email,
-    reason: entry.reason ?? 'manual',
-    source: entry.source ?? 'api-bulk',
-    metadata: entry.metadata,
-  }))
+    await logAudit(
+      auditFromApiKey(req, auth),
+      'suppression.bulk_import',
+      { type: 'suppression', id: null },
+      { submitted: inputs.length, inserted: result.inserted, skipped: result.skipped },
+    )
 
-  const result = await suppressEmailsBulk(inputs)
-  return NextResponse.json({ data: result, meta: { submitted: inputs.length }, error: null }, { status: 201 })
+    return NextResponse.json({ data: result, meta: { submitted: inputs.length }, error: null }, { status: 201 })
+  })
 }
diff --git a/app/api/v1/suppressions/route.ts b/app/api/v1/suppressions/route.ts
index 0f8b0ee..47f79d4 100644
--- a/app/api/v1/suppressions/route.ts
+++ b/app/api/v1/suppressions/route.ts
@@ -2,66 +2,71 @@ import { NextRequest, NextResponse } from 'next/server'
 import { db } from '@/lib/db'
 import { suppressions } from '@/lib/db/schema'
 import { ilike, sql, desc } from 'drizzle-orm'
-import { authenticateApiKey } from '@/lib/api-auth'
+import { withApiAuth } from '@/lib/api-auth'
 import { createSuppressionSchema } from '@/lib/validations/suppressions'
 import { suppressEmail, normalizeEmail } from '@/lib/suppressions'
+import { auditFromApiKey, logAudit } from '@/lib/audit'
 
 export async function GET(req: NextRequest) {
-  if (!(await authenticateApiKey(req))) {
-    return NextResponse.json({ error: 'Unauthorized', data: null, meta: {} }, { status: 401 })
-  }
+  return withApiAuth(req, async () => {
+    const { searchParams } = new URL(req.url)
+    const page = Math.max(1, parseInt(searchParams.get('page') ?? '1', 10) || 1)
+    const limitRaw = parseInt(searchParams.get('limit') ?? '50', 10) || 50
+    const limit = Math.min(200, Math.max(1, limitRaw))
+    const search = (searchParams.get('search') ?? '').trim()
 
-  const { searchParams } = new URL(req.url)
-  const page = Math.max(1, parseInt(searchParams.get('page') ?? '1', 10) || 1)
-  const limitRaw = parseInt(searchParams.get('limit') ?? '50', 10) || 50
-  const limit = Math.min(200, Math.max(1, limitRaw))
-  const search = (searchParams.get('search') ?? '').trim()
+    const where = search ? ilike(suppressions.email, `%${search.toLowerCase()}%`) : undefined
 
-  const where = search ? ilike(suppressions.email, `%${search.toLowerCase()}%`) : undefined
+    const dataQuery = db
+      .select()
+      .from(suppressions)
+      .orderBy(desc(suppressions.createdAt))
+      .limit(limit)
+      .offset((page - 1) * limit)
+    const data = where ? await dataQuery.where(where) : await dataQuery
 
-  const dataQuery = db
-    .select()
-    .from(suppressions)
-    .orderBy(desc(suppressions.createdAt))
-    .limit(limit)
-    .offset((page - 1) * limit)
-  const data = where ? await dataQuery.where(where) : await dataQuery
+    const totalQuery = db.select({ count: sql<number>`count(*)::int` }).from(suppressions)
+    const totalRows = where ? await totalQuery.where(where) : await totalQuery
+    const total = totalRows[0]?.count ?? 0
 
-  const totalQuery = db.select({ count: sql<number>`count(*)::int` }).from(suppressions)
-  const totalRows = where ? await totalQuery.where(where) : await totalQuery
-  const total = totalRows[0]?.count ?? 0
-
-  return NextResponse.json({ data, meta: { page, limit, total }, error: null })
+    return NextResponse.json({ data, meta: { page, limit, total }, error: null })
+  })
 }
 
 export async function POST(req: NextRequest) {
-  if (!(await authenticateApiKey(req))) {
-    return NextResponse.json({ error: 'Unauthorized', data: null, meta: {} }, { status: 401 })
-  }
+  return withApiAuth(req, async (auth) => {
+    let body: unknown
+    try {
+      body = await req.json()
+    } catch {
+      return NextResponse.json({ error: 'Invalid JSON body', data: null, meta: {} }, { status: 400 })
+    }
+
+    const parsed = createSuppressionSchema.safeParse(body)
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validation failed', data: null, meta: { details: parsed.error.flatten() } },
+        { status: 400 }
+      )
+    }
 
-  let body: unknown
-  try {
-    body = await req.json()
-  } catch {
-    return NextResponse.json({ error: 'Invalid JSON body', data: null, meta: {} }, { status: 400 })
-  }
+    const email = normalizeEmail(parsed.data.email)
+    await suppressEmail({
+      email,
+      reason: parsed.data.reason ?? 'manual',
+      source: parsed.data.source ?? 'api',
+      metadata: parsed.data.metadata,
+    })
 
-  const parsed = createSuppressionSchema.safeParse(body)
-  if (!parsed.success) {
-    return NextResponse.json(
-      { error: 'Validation failed', data: null, meta: { details: parsed.error.flatten() } },
-      { status: 400 }
+    const [row] = await db.select().from(suppressions).where(sql`${suppressions.email} = ${email}`).limit(1)
+
+    await logAudit(
+      auditFromApiKey(req, auth),
+      'suppression.create',
+      { type: 'suppression', id: row?.id ?? null },
+      { email, reason: parsed.data.reason ?? 'manual', source: parsed.data.source ?? 'api' },
     )
-  }
 
-  const email = normalizeEmail(parsed.data.email)
-  await suppressEmail({
-    email,
-    reason: parsed.data.reason ?? 'manual',
-    source: parsed.data.source ?? 'api',
-    metadata: parsed.data.metadata,
+    return NextResponse.json({ data: row, meta: {}, error: null }, { status: 201 })
   })
-
-  const [row] = await db.select().from(suppressions).where(sql`${suppressions.email} = ${email}`).limit(1)
-  return NextResponse.json({ data: row, meta: {}, error: null }, { status: 201 })
 }
diff --git a/app/api/webhooks/resend/route.ts b/app/api/webhooks/resend/route.ts
index fe8c5df..6f4e2c3 100644
--- a/app/api/webhooks/resend/route.ts
+++ b/app/api/webhooks/resend/route.ts
@@ -4,11 +4,13 @@ import { campaignSends, campaignEvents, contacts } from '@/lib/db/schema'
 import { eq } from 'drizzle-orm'
 import { Webhook } from 'svix'
 import { suppressEmail } from '@/lib/suppressions'
+import { logAudit, systemAuditCtx } from '@/lib/audit'
 
 async function handleBounceOrComplaint(
   providerMessageId: string,
   contactStatus: string,
-  eventType: string
+  eventType: string,
+  source: string,
 ) {
   const [send] = await db
     .select()
@@ -26,7 +28,7 @@ async function handleBounceOrComplaint(
     .update(contacts)
     .set({ status: contactStatus })
     .where(eq(contacts.id, send.contactId))
-    .returning({ email: contacts.email })
+    .returning({ id: contacts.id, email: contacts.email })
 
   await db.insert(campaignEvents).values({
     campaignSendId: send.id,
@@ -34,13 +36,33 @@ async function handleBounceOrComplaint(
     type: eventType,
   })
 
+  if (contact?.id) {
+    await logAudit(
+      systemAuditCtx(undefined, `webhook:${source}`),
+      eventType === 'bounce' ? 'contact.bounced' : 'contact.complained',
+      { type: 'contact', id: contact.id },
+      { providerMessageId, campaignId: send.campaignId, campaignSendId: send.id, source },
+    )
+  }
+
   if (contact?.email) {
     await suppressEmail({
       email: contact.email,
       reason: eventType === 'complaint' ? 'complaint' : 'bounce',
-      source: 'resend',
+      source,
       metadata: { providerMessageId, campaignId: send.campaignId, campaignSendId: send.id },
     })
+
+    await logAudit(
+      systemAuditCtx(undefined, `webhook:${source}`),
+      'suppression.auto_create',
+      { type: 'suppression', id: null },
+      {
+        email: contact.email,
+        reason: eventType === 'complaint' ? 'complaint' : 'bounce',
+        source: `webhook:${source}`,
+      },
+    )
   }
 }
 
@@ -64,9 +86,9 @@ export async function POST(req: NextRequest) {
     const { type, data } = event
 
     if (type === 'email.bounced') {
-      await handleBounceOrComplaint(data.email_id, 'bounced', 'bounce')
+      await handleBounceOrComplaint(data.email_id, 'bounced', 'bounce', 'resend')
     } else if (type === 'email.complained') {
-      await handleBounceOrComplaint(data.email_id, 'unsubscribed', 'complaint')
+      await handleBounceOrComplaint(data.email_id, 'unsubscribed', 'complaint', 'resend')
     }
 
     return NextResponse.json({ received: true })
diff --git a/app/api/webhooks/ses/route.ts b/app/api/webhooks/ses/route.ts
index 130c213..ab73985 100644
--- a/app/api/webhooks/ses/route.ts
+++ b/app/api/webhooks/ses/route.ts
@@ -3,6 +3,7 @@ import { db } from '@/lib/db'
 import { campaignSends, campaignEvents, contacts } from '@/lib/db/schema'
 import { eq } from 'drizzle-orm'
 import { suppressEmail } from '@/lib/suppressions'
+import { logAudit, systemAuditCtx } from '@/lib/audit'
 
 async function handleBounceOrComplaint(
   providerMessageId: string,
@@ -26,7 +27,7 @@ async function handleBounceOrComplaint(
     .update(contacts)
     .set({ status: contactStatus })
     .where(eq(contacts.id, send.contactId))
-    .returning({ email: contacts.email })
+    .returning({ id: contacts.id, email: contacts.email })
 
   await db.insert(campaignEvents).values({
     campaignSendId: send.id,
@@ -34,6 +35,15 @@ async function handleBounceOrComplaint(
     type: eventType,
   })
 
+  if (contact?.id) {
+    await logAudit(
+      systemAuditCtx(undefined, 'webhook:ses'),
+      eventType === 'bounce' ? 'contact.bounced' : 'contact.complained',
+      { type: 'contact', id: contact.id },
+      { providerMessageId, campaignId: send.campaignId, campaignSendId: send.id, source: 'ses' },
+    )
+  }
+
   if (shouldSuppress && contact?.email) {
     await suppressEmail({
       email: contact.email,
@@ -41,6 +51,17 @@ async function handleBounceOrComplaint(
       source: 'ses',
       metadata: { providerMessageId, campaignId: send.campaignId, campaignSendId: send.id },
     })
+
+    await logAudit(
+      systemAuditCtx(undefined, 'webhook:ses'),
+      'suppression.auto_create',
+      { type: 'suppression', id: null },
+      {
+        email: contact.email,
+        reason: eventType === 'complaint' ? 'complaint' : 'bounce',
+        source: 'webhook:ses',
+      },
+    )
   }
 }
 
diff --git a/app/unsubscribe/[token]/page.tsx b/app/unsubscribe/[token]/page.tsx
index 3138b19..4eaa928 100644
--- a/app/unsubscribe/[token]/page.tsx
+++ b/app/unsubscribe/[token]/page.tsx
@@ -3,6 +3,7 @@ import { contacts, lists, campaignSends, campaignEvents } from '@/lib/db/schema'
 import { eq, desc } from 'drizzle-orm'
 import { redirect } from 'next/navigation'
 import { suppressEmail } from '@/lib/suppressions'
+import { logAudit, systemAuditCtx } from '@/lib/audit'
 
 async function getContactByToken(token: string) {
   const result = await db
@@ -62,6 +63,18 @@ async function unsubscribeAction(formData: FormData) {
     metadata: { contactId: contact.id, listId: contact.listId },
   })
 
+  await logAudit(
+    systemAuditCtx(undefined, 'unsubscribe-link'),
+    'contact.unsubscribed',
+    { type: 'contact', id: contact.id },
+    {
+      email: contact.email,
+      listId: contact.listId,
+      source: 'one_click',
+      campaignId: recentSend[0]?.campaignId ?? null,
+    },
+  )
+
   redirect(`/unsubscribe/${token}`)
 }
 
diff --git a/drizzle/migrations/0002_audit_log_hardening.sql b/drizzle/migrations/0002_audit_log_hardening.sql
new file mode 100644
index 0000000..66a58b7
--- /dev/null
+++ b/drizzle/migrations/0002_audit_log_hardening.sql
@@ -0,0 +1,50 @@
+-- Append-only enforcement for audit_logs and a privileged retention purge function.
+-- The retention purge function bypasses the no-update/no-delete triggers via
+-- `session_replication_role = 'replica'`, scoped to the function call only.
+
+CREATE OR REPLACE FUNCTION prevent_audit_log_mutation() RETURNS TRIGGER AS $$
+BEGIN
+  RAISE EXCEPTION 'audit_logs is append-only';
+END;
+$$ LANGUAGE plpgsql;
+--> statement-breakpoint
+
+DROP TRIGGER IF EXISTS audit_logs_no_update ON audit_logs;
+--> statement-breakpoint
+CREATE TRIGGER audit_logs_no_update
+BEFORE UPDATE ON audit_logs
+FOR EACH ROW EXECUTE FUNCTION prevent_audit_log_mutation();
+--> statement-breakpoint
+
+DROP TRIGGER IF EXISTS audit_logs_no_delete ON audit_logs;
+--> statement-breakpoint
+CREATE TRIGGER audit_logs_no_delete
+BEFORE DELETE ON audit_logs
+FOR EACH ROW EXECUTE FUNCTION prevent_audit_log_mutation();
+--> statement-breakpoint
+
+CREATE OR REPLACE FUNCTION audit_logs_retention_purge(retention_days INT)
+RETURNS TABLE (deleted INT, cutoff TIMESTAMPTZ)
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_cutoff TIMESTAMPTZ;
+  v_deleted INT;
+BEGIN
+  IF retention_days IS NULL OR retention_days <= 0 THEN
+    RETURN QUERY SELECT 0, NULL::TIMESTAMPTZ;
+    RETURN;
+  END IF;
+
+  v_cutoff := now() - (retention_days || ' days')::interval;
+
+  SET LOCAL session_replication_role = 'replica';
+  WITH del AS (
+    DELETE FROM audit_logs WHERE created_at < v_cutoff RETURNING 1
+  )
+  SELECT COUNT(*)::INT INTO v_deleted FROM del;
+
+  RETURN QUERY SELECT v_deleted, v_cutoff;
+END;
+$$;
diff --git a/drizzle/migrations/meta/0002_snapshot.json b/drizzle/migrations/meta/0002_snapshot.json
new file mode 100644
index 0000000..bb82fa9
--- /dev/null
+++ b/drizzle/migrations/meta/0002_snapshot.json
@@ -0,0 +1,681 @@
+{
+  "id": "378e93f9-e1c7-4ee8-bdaf-4e645c039b90",
+  "prevId": "c66073d7-a246-4a46-8ee5-225f1fc78ebe",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.api_keys": {
+      "name": "api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "api_keys_key_hash_unique": {
+          "name": "api_keys_key_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "key_hash"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.campaign_events": {
+      "name": "campaign_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "campaign_send_id": {
+          "name": "campaign_send_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "campaign_id": {
+          "name": "campaign_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "link_url": {
+          "name": "link_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "campaign_events_campaign_send_id_campaign_sends_id_fk": {
+          "name": "campaign_events_campaign_send_id_campaign_sends_id_fk",
+          "tableFrom": "campaign_events",
+          "tableTo": "campaign_sends",
+          "columnsFrom": [
+            "campaign_send_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "campaign_events_campaign_id_campaigns_id_fk": {
+          "name": "campaign_events_campaign_id_campaigns_id_fk",
+          "tableFrom": "campaign_events",
+          "tableTo": "campaigns",
+          "columnsFrom": [
+            "campaign_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.campaign_sends": {
+      "name": "campaign_sends",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "campaign_id": {
+          "name": "campaign_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "contact_id": {
+          "name": "contact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "provider_message_id": {
+          "name": "provider_message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "campaign_sends_campaign_id_campaigns_id_fk": {
+          "name": "campaign_sends_campaign_id_campaigns_id_fk",
+          "tableFrom": "campaign_sends",
+          "tableTo": "campaigns",
+          "columnsFrom": [
+            "campaign_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "campaign_sends_contact_id_contacts_id_fk": {
+          "name": "campaign_sends_contact_id_contacts_id_fk",
+          "tableFrom": "campaign_sends",
+          "tableTo": "contacts",
+          "columnsFrom": [
+            "contact_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "campaign_sends_campaign_id_contact_id_unique": {
+          "name": "campaign_sends_campaign_id_contact_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "campaign_id",
+            "contact_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.campaigns": {
+      "name": "campaigns",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "from_name": {
+          "name": "from_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "from_email": {
+          "name": "from_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "list_id": {
+          "name": "list_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_json": {
+          "name": "template_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "template_html": {
+          "name": "template_html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "scheduled_at": {
+          "name": "scheduled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_recipients": {
+          "name": "total_recipients",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancel_requested": {
+          "name": "cancel_requested",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "campaigns_list_id_lists_id_fk": {
+          "name": "campaigns_list_id_lists_id_fk",
+          "tableFrom": "campaigns",
+          "tableTo": "lists",
+          "columnsFrom": [
+            "list_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "campaigns_provider_id_email_providers_id_fk": {
+          "name": "campaigns_provider_id_email_providers_id_fk",
+          "tableFrom": "campaigns",
+          "tableTo": "email_providers",
+          "columnsFrom": [
+            "provider_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.contacts": {
+      "name": "contacts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "list_id": {
+          "name": "list_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "first_name": {
+          "name": "first_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_name": {
+          "name": "last_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "unsubscribe_token": {
+          "name": "unsubscribe_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "contacts_list_id_lists_id_fk": {
+          "name": "contacts_list_id_lists_id_fk",
+          "tableFrom": "contacts",
+          "tableTo": "lists",
+          "columnsFrom": [
+            "list_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "contacts_unsubscribe_token_unique": {
+          "name": "contacts_unsubscribe_token_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "unsubscribe_token"
+          ]
+        },
+        "contacts_list_id_email_unique": {
+          "name": "contacts_list_id_email_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "list_id",
+            "email"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.email_providers": {
+      "name": "email_providers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_encrypted": {
+          "name": "config_encrypted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "rate_limit_per_second": {
+          "name": "rate_limit_per_second",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.lists": {
+      "name": "lists",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.suppressions": {
+      "name": "suppressions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "suppressions_email_unique": {
+          "name": "suppressions_email_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "email"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/drizzle/migrations/meta/_journal.json b/drizzle/migrations/meta/_journal.json
index 7c2334f..162d49f 100644
--- a/drizzle/migrations/meta/_journal.json
+++ b/drizzle/migrations/meta/_journal.json
@@ -15,6 +15,13 @@
       "when": 1777752836747,
       "tag": "0001_woozy_silvermane",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1778025600000,
+      "tag": "0002_audit_log_hardening",
+      "breakpoints": true
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/lib/audit/index.ts b/lib/audit/index.ts
index 234f345..25ca7d2 100644
--- a/lib/audit/index.ts
+++ b/lib/audit/index.ts
@@ -88,3 +88,13 @@ export function auditFromApiKey(req: NextRequest, auth: ApiAuthContext): AuditCo
     ...meta,
   }
 }
+
+export function systemAuditCtx(req?: NextRequest, label = 'system'): AuditContext {
+  const meta = req ? extractRequestMeta(req) : { ipAddress: null, userAgent: null }
+  return {
+    actorType: 'system',
+    actorId: null,
+    actorLabel: label,
+    ...meta,
+  }
+}
diff --git a/lib/queue/index.ts b/lib/queue/index.ts
index 5971e22..d2528b5 100644
--- a/lib/queue/index.ts
+++ b/lib/queue/index.ts
@@ -10,7 +10,7 @@ export async function getQueue(): Promise<PgBoss> {
     })
     await boss.start()
     // Create queues if they don't exist (required in pg-boss v12+)
-    for (const queue of [JOBS.SEND_EMAIL, JOBS.FINALIZE_CAMPAIGN]) {
+    for (const queue of [JOBS.SEND_EMAIL, JOBS.FINALIZE_CAMPAIGN, JOBS.PURGE_AUDIT_LOGS]) {
       try {
         await boss.createQueue(queue)
       } catch (e: unknown) {
@@ -26,4 +26,5 @@ export const JOBS = {
   SEND_CAMPAIGN: 'send-campaign',
   SEND_EMAIL: 'send-email',
   FINALIZE_CAMPAIGN: 'finalize-campaign',
+  PURGE_AUDIT_LOGS: 'purge-audit-logs',
 } as const
diff --git a/lib/suppressions/index.ts b/lib/suppressions/index.ts
index 19397da..f707533 100644
--- a/lib/suppressions/index.ts
+++ b/lib/suppressions/index.ts
@@ -70,9 +70,12 @@ export async function suppressEmailsBulk(
   return { inserted, skipped: rows.length - inserted }
 }
 
-export async function unsuppressEmailById(id: string): Promise<boolean> {
-  const result = await db.delete(suppressions).where(eq(suppressions.id, id)).returning({ id: suppressions.id })
-  return result.length > 0
+export async function unsuppressEmailById(id: string): Promise<{ id: string; email: string } | null> {
+  const result = await db
+    .delete(suppressions)
+    .where(eq(suppressions.id, id))
+    .returning({ id: suppressions.id, email: suppressions.email })
+  return result[0] ?? null
 }
 
 export async function unsuppressEmail(email: string): Promise<boolean> {
diff --git a/worker.ts b/worker.ts
index ae417d3..dc3b519 100644
--- a/worker.ts
+++ b/worker.ts
@@ -7,6 +7,8 @@ import { renderTemplate, renderPlainText } from './lib/renderer'
 import { JOBS } from './lib/queue'
 import { logger, trackEvent, trackError, shutdownTracking } from './lib/logger'
 import { isSuppressed } from './lib/suppressions'
+import { logAudit, systemAuditCtx } from './lib/audit'
+import { sql } from 'drizzle-orm'
 
 const APP_URL = process.env.APP_URL!
 const CONCURRENCY = parseInt(process.env.WORKER_CONCURRENCY || '5')
@@ -159,7 +161,7 @@ async function main() {
   logger.info('pg-boss started')
 
   // Create queues if they don't exist (required in pg-boss v12+)
-  for (const queue of [JOBS.SEND_EMAIL, JOBS.FINALIZE_CAMPAIGN]) {
+  for (const queue of [JOBS.SEND_EMAIL, JOBS.FINALIZE_CAMPAIGN, JOBS.PURGE_AUDIT_LOGS]) {
     try {
       await boss.createQueue(queue)
       logger.info({ queue }, 'Queue created')
@@ -192,6 +194,12 @@ async function main() {
             await db.update(campaignSends)
               .set({ status: 'failed', errorMessage })
               .where(eq(campaignSends.id, job.data.sendId))
+            await logAudit(
+              systemAuditCtx(undefined, 'worker'),
+              'campaign_send.failed',
+              { type: 'campaign_send', id: job.data.sendId },
+              { campaignId: job.data.campaignId, errorMessage },
+            )
           } catch (dbErr) {
             logger.error({ err: dbErr, sendId: job.data.sendId }, 'Failed to update send status after error')
           }
@@ -207,6 +215,27 @@ async function main() {
       logger.info({ campaignId }, 'Finalizing campaign')
       try {
         await db.update(campaigns).set({ status: 'sent', sentAt: new Date() }).where(eq(campaigns.id, campaignId))
+
+        const [stats] = await db
+          .select({
+            total: sql<number>`count(*)::int`,
+            sent: sql<number>`count(case when ${campaignSends.status} = 'sent' then 1 end)::int`,
+            failed: sql<number>`count(case when ${campaignSends.status} = 'failed' then 1 end)::int`,
+          })
+          .from(campaignSends)
+          .where(eq(campaignSends.campaignId, campaignId))
+
+        await logAudit(
+          systemAuditCtx(undefined, 'worker'),
+          'campaign.finalized',
+          { type: 'campaign', id: campaignId },
+          {
+            totalRecipients: stats?.total ?? 0,
+            sent: stats?.sent ?? 0,
+            failed: stats?.failed ?? 0,
+          },
+        )
+
         logger.info({ campaignId }, 'Campaign finalized successfully')
         trackEvent('campaign_finalized', { campaignId })
       } catch (err) {
@@ -216,6 +245,41 @@ async function main() {
     }
   })
 
+  // Periodic audit log retention purge
+  await boss.work<Record<string, never>>(JOBS.PURGE_AUDIT_LOGS, async (jobs) => {
+    for (const job of jobs) {
+      const days = parseInt(process.env.AUDIT_LOG_RETENTION_DAYS ?? '365', 10)
+      if (!Number.isFinite(days) || days <= 0) {
+        logger.info({ jobId: job.id, days }, 'Audit log retention disabled, skipping purge')
+        continue
+      }
+      logger.info({ jobId: job.id, days }, 'Purging audit logs')
+      try {
+        const result = await db.execute(sql`select * from audit_logs_retention_purge(${days}::int)`)
+        const rows = (result as unknown as { rows?: { deleted: number; cutoff: string }[] }).rows
+          ?? (Array.isArray(result) ? (result as { deleted: number; cutoff: string }[]) : [])
+        const row = rows[0]
+        await logAudit(
+          systemAuditCtx(undefined, 'retention'),
+          'audit.retention_purge',
+          { type: 'audit_log', id: null },
+          { deleted: row?.deleted ?? 0, cutoff: row?.cutoff ?? null, retentionDays: days },
+        )
+        logger.info({ deleted: row?.deleted, cutoff: row?.cutoff }, 'Audit log purge complete')
+      } catch (err) {
+        logger.error({ err }, 'Audit log purge failed')
+        trackError(err, { action: 'purge_audit_logs' })
+      }
+    }
+  })
+
+  try {
+    await boss.schedule(JOBS.PURGE_AUDIT_LOGS, '0 3 * * *', {}, { tz: 'UTC' })
+    logger.info('Audit log retention scheduled (daily 03:00 UTC)')
+  } catch (err) {
+    logger.warn({ err }, 'Failed to schedule audit log retention; will continue without it')
+  }
+
   logger.info('Worker ready, processing jobs')
   trackEvent('worker_started', { concurrency: CONCURRENCY })