Compliance

Regulatory frameworks such as GDPR and HIPAA require organizations to keep traceable records of how data moves between their applications and the services they rely on. Because HARP sits as a forward proxy between your applications and the remote APIs they call, every request and response can be recorded in one place, without changing application code.

Understanding the use case

When an application talks to many external APIs, the trail of what was sent and received is scattered across services and rarely captured consistently. Demonstrating compliance then means reconstructing that history after the fact. Routing this traffic through HARP gives you a single, consistent point where HTTP activity is observed and stored, making it easier to inspect and to show during an audit.

What HARP records

HARP's audit log is enabled automatically. It records every transaction passing through the proxy, both the HTTP request and the response, whether or not the request was forwarded to a remote backend. Each API transaction can be reviewed in the HARP dashboard, so you can trace activity and look into suspicious calls or usage involving personally identifiable information.

Stored transactions are cleaned up automatically by the Janitor application after a configurable delay, so you can align retention with your own requirements. Under heavy load, the background worker may skip storing some transactions to keep processing requests, a deliberate trade-off that prioritizes serving traffic over complete logging.

Transport security

HARP forwards HTTP traffic to the upstream servers you configure. To keep data protected in transit so that nobody eavesdrops on the wire, point your remote pools at HTTPS endpoints. Transport encryption is then handled by TLS between HARP and the upstream API.

Putting it in place

• Keep the audit log on: the audit log runs by default. Review it in the dashboard and set the retention delay to match the period your regulations require.
• Minimize sensitive data: where regulations call for it, use anonymization and pseudonymization rules to mask or replace PII in transit, so it never reaches your logs or downstream services.
• Route compliance-sensitive traffic through HARP: send the API calls you need to account for through the proxy so they are captured consistently in one place.
• Use HTTPS upstreams: configure remote pools with HTTPS endpoints so traffic stays encrypted in transit.
• Monitor continuously: use HARP's dashboard and monitoring to keep an eye on activity and spot anomalies as they happen.

Benefits

• Traceability: a consistent record of requests and responses makes it easier to reconstruct what happened and to demonstrate it during an audit.
• Centralized visibility: instead of stitching logs together from many services, you get one place to inspect HTTP activity.
• No application changes: capturing this history requires configuring the proxy, not rewriting your services.