Secure backups and audit logs in Strapi 5 for GDPR‑compliant applications

In Strapi 5 you can protect data integrity and meet GDPR obligations by combining encrypted exports, automated cloud backups, and built‑in audit logging. Below is a practical guide that shows how to store secrets safely, configure session cookies, enable audit logs, create regular backups, and retain data for the legally required periods.

Overview

Strapi 5 separates configuration, runtime secrets, and data storage, which makes it easier to apply defense‑in‑depth controls. The key pieces you need to address are:

1. Secret management – keep APP_KEYS, JWT secrets, and database passwords out of source control.
2. Session hardening – enforce Secure, HttpOnly, and SameSite flags.
3. Audit logging – capture who did what and for how long.
4. Backup strategy – choose between Strapi Cloud automated backups or self‑hosted encrypted exports.
5. GDPR‑ready retention – define retention periods, enable export/deletion endpoints, and anonymize IP addresses in logs.

The following sections walk through each step with concrete configuration files and CLI commands.

1. Secure secret management

Never commit plain‑text secrets. Strapi reads most secrets from environment variables, which you can provide via a .env file in development and a secret manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, etc.) in production.

# .env (development only – never commit this file)
HOST=0.0.0.0
PORT=1337
APP_KEYS="changeMe1,changeMe2"
API_TOKEN_SALT=changeMe3
ADMIN_JWT_SECRET=changeMe4
JWT_SECRET=changeMe5
# Example session TTL – one week
UP_SESSIONS_ACCESS_TTL=604800

All secret names are documented in the Strapi environment guide【1†L22-L57】. When deploying to a container platform, inject the variables at runtime and remove the .env file from the image.

Production tip

Store the values in a dedicated secret store and reference them in your container definition, e.g.:

env:
  - name: APP_KEYS
    valueFrom:
      secretKeyRef:
        name: strapi-secrets
        key: APP_KEYS

2. Harden session cookies

Strapi uses the koa-session middleware. Overriding its defaults in config/env/production/middlewares.js lets you enforce the strongest cookie attributes.

// config/env/production/middlewares.js
module.exports = [{
  name: 'strapi::session',
  config: {
    rolling: true,          // refresh expiry on each request
    renew: true,            // issue a new cookie when close to expiry
    httpOnly: true,         // not accessible via JavaScript
    secure: true,           // only over HTTPS
    sameSite: 'strict',     // prevent CSRF
    maxAge: 86400000,       // 24 h in ms
  },
}];

The options match the recommendations from the Strapi security middleware guide【11†L575-L590】.

3. Enable and configure audit logs

Audit logging is an Enterprise‑only feature but can also be added via community plugins. The built‑in EE audit log records admin logins, token creation, content CRUD, and media changes.

// config/admin.js (Enterprise edition)
module.exports = ({ env }) => ({
  auditLogs: {
    enabled: true,
    retentionDays: 30,        // keep logs for 30 days (adjust for GDPR)
    exportMaxRows: 1000000,   // max rows per CSV export
  },
});

If you use the free tier, the community plugin strapi-plugin-audit-logs provides similar capabilities【23†L0-L10】.

GDPR‑specific settings

Strapi allows IP anonymization in the audit log. Add the privacy config in config/plugins.js:

module.exports = ({ env }) => ({
  // other plugins …
  auditLogs: {
    enabled: true,
    anonymizeIP: true, // strip the last octet of IPv4 addresses
  },
});

Anonymizing IPs helps you meet the GDPR principle of data minimisation.

4. Backup strategy

Backups must be regular, encrypted, and tested. Strapi offers two paths:

4.1. Strapi Cloud automated backups

For projects hosted on Strapi Cloud, the platform creates daily backups for Business plans and weekly backups for Pro plans【15†L8-L19】. Retention is one month with the four most recent backups kept. You can trigger a manual backup from the dashboard; only one manual snapshot exists at a time, so schedule it during low‑traffic windows.

4.2. Self‑hosted encrypted export

When you run Strapi on your own infrastructure, use the CLI export command. The command creates a compressed and encrypted archive (.tar.gz.enc).

# Create an encrypted backup (replace <key> with a 32‑byte base64 string)
export ENCRYPTION_KEY="<key>"
yarn strapi export --key $ENCRYPTION_KEY --format tar.gz

Options:

• --no-encrypt skips encryption (not recommended).
• --only <model> limits the export to specific collections.
• --exclude <model> omits large assets.

Import works with strapi import --key $ENCRYPTION_KEY【17†L8-L17】【17†L61-L70】.

5. Retention and export for GDPR

GDPR requires you to:

1. Delete personal data when the legal basis expires.
2. Provide data portability on request.
3. Keep logs only as long as necessary.

5.1. Data deletion

Strapi’s admin UI lets you delete entries permanently. For bulk erasure, write a script that calls the Content API with the delete method for each user‑related record, then runs strapi export to verify the data is gone.

// Example Node script using the SDK
const strapi = require('@strapi/sdk');
(async () => {
  const users = await strapi.getEntries('users');
  for (const u of users) {
    await strapi.deleteEntry('users', u.id);
  }
})();

5.2. Data portability

The export CLI produces a GDPR‑compatible package that includes raw JSON for each collection, which can be handed to the data subject.

5.3. Log retention

Set retentionDays in the audit‑log config to the minimum period your organization needs (e.g., 30 days). For longer retention, archive older logs to a separate secure storage and delete them from the primary database.

6. Verifying backup integrity

Automated checks prevent silent corruption.

1. Hash verification – after each export, compute a SHA‑256 hash and store it alongside the backup.
2. Restore test – schedule a weekly restore into a staging environment and run a smoke test against the API.
3. Alert on failures – integrate the backup script with your monitoring (e.g., Prometheus alerts on non‑zero exit codes).

# Generate hash after export
sha256sum backup-$(date +%F).tar.gz.enc > backup-$(date +%F).sha256

7. Checklist for a GDPR‑ready backup and audit setup

8. Conclusion

By centralising secret management, tightening session cookies, enabling audit logs, and adopting an encrypted backup routine, a Strapi 5 application can satisfy both security best practices and GDPR’s accountability requirements. Automate the steps, monitor the outcomes, and keep the retention policies aligned with your legal obligations. The result is a resilient headless CMS that protects user data without sacrificing developer agility.