INFO logs contain operational metadata only: user hash, query ID, latency, and outcome. Query text, chunk text, answer text, secrets, provider keys, and database credentials are redacted.
Operator deletion tombstones identity mappings while preserving immutable ledger verification. Ledger content retention is deployment policy and must be approved by the customer.