drop card-data system audit trail · detect logging gaps + missing retention · runs locally
flags log gaps · missing auth events · admin without audit markers · retention below policy · CHD access events
auto-analyzes on file drop
heuristic screener · parses artifacts locally · not definitive proof