This guide explains exactly why "log everything" conflicts with SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001, NIST CSF, and CCPA, and presents the metadata-only logging pattern (content: false) plus a SHA-256 hash chain that satisfies the same evidence requirements without storing prompts.