Local audit and optional encryption
Review the metadata retained by the audit, how the signed chain works and when to use X25519 encryption.
From masking to the audit log
When TigerMole detects a sensitive value in a supported workflow, it replaces that value locally before sending the request to the provider selected by Claude Code or Codex. The persistent audit records metadata such as ts_ms, rule_id, gdpr_category, confidence, field_path, prev_hash and sig.
The audit does not include the prompt, response or original secret. Records remain on the device and are not sent to TigerMole.
The chain links each entry to the previous one. With Team, ED25519 can reveal changes to the entries that are present; signing alone does not prove that the record is complete.
Optional X25519 encryption
Team lets an organization import an X25519 public key to encrypt logs or exports intended for review. This is an advanced confidentiality option and is not required to install, activate or use TigerMole.
Encryption does not enable value capture: the persistent audit remains limited to metadata.
To review a compatible encrypted file, open the decryptor, load the X25519 private key and select the file. The cryptographic operation runs in the browser; the tool does not upload the key or log to TigerMole.
Verifying integrity
To validate the installation and local chain:
tigermole-proxy verify
tigermole-proxy doctor
If you use encryption, keep the public key and retention policy with the operational runbook. Store the private key separately from the logs.