This page explains how Boomerang logs activity related to the Developer API and dashboard, how long those logs are typically retained, and where the privacy boundaries sit.It should be read together with the Boomerang Privacy Policy, which governs how personal information is handled, and with:
Boomerang logs operational and audit events to secure and operate the Developer API. In summary:
API requests
For each API request, Boomerang records metadata such as:
HTTP method, path, and status code
Response time
Server ID and, where applicable, associated user ID
Token identifier (not the raw token value)
Source IP address and high-level user agent details
Dashboard and administrative actions
For sensitive actions in the dashboard, Boomerang records:
Action type (for example, token created, rotated, or revoked; settings changed)
Actor identity (for example, the authenticated user performing the action)
Timestamp and source IP address
Relevant identifiers (for example, which server and which token)
Example: Boomerang logs that a particular administrator created a token for a specific server from a given IP address, but does not log the full token value or any payload content.
Metadata only, not content
Boomerang focuses on , and does not log:
Message content
Full payload bodies
Large data structures returned by the API
This logging is used for security, operations, and abuse detection, not for advertising or profiling.
Operational and audit logs are kept for limited periods.
Operational logs (for example, routine request/response metadata) are typically retained for up to 90 days, subject to operational and legal requirements.
Audit logs (for example, token creation/rotation/revocation, key configuration changes) may be retained for up to 12 months, particularly where needed for security and compliance.
Actual retention periods and any jurisdiction-specific variations are governed by, and should be interpreted in line with, the Boomerang Privacy Policy.
Only authorised Boomerang staff may access logs, and only for:
Operating and maintaining the service
Security monitoring, investigation, and abuse detection
Supporting customers and resolving incidents
Boilerplate:
Logs may be processed using Boomerang’s internal tooling and selected processors; details of any such processing and international transfers are covered in the Boomerang Privacy Policy.
Integrators are expected to maintain their own audit trail for their systems and usage of the Developer API, while respecting privacy and secrecy requirements.Minimum expectations:
Log for diagnosis and security
Record timestamps, HTTP status codes, and key identifiers (for example, server IDs).
Capture X-Request-Id (your correlation ID) and store trace_id values from error responses to support joint investigations.
Avoid logging sensitive content
Do not log full token values, passwords, or other secrets.
Avoid logging personal information unless strictly necessary, and ensure any such logging complies with laws that apply to you.
Align with your own compliance obligations
Apply appropriate retention and access controls to your logs.
Treat logs as potentially sensitive, particularly where they include identifiers or limited personal information.
Your logging and audit obligations are determined by your own legal, regulatory, and contractual environment; this page does not constitute legal advice.
