Audit trail covers opt-out processing events

GDPR Article 7(3) and CAN-SPAM §7704(a)(4) require opt-outs to be honored within a defined window — but "honored" means demonstrably processed end-to-end, not just acknowledged at the API boundary. CWE-778 (Insufficient Logging) applies directly: if the opt-out worker writes only a consent record but no audit log events, you cannot reconstruct when the job started, how long ESP suppression took, or whether the 10-business-day CAN-SPAM window was met for any specific request. When a data subject or regulator asks for the processing timeline of their opt-out, a consent record showing granted = false with no operational context is an incomplete answer.

Add audit log writes at each stage of the opt-out worker's processing pipeline, not just at completion:

// src/workers/optout.ts
queue.process('process-optout', async (job) => {
  const { contactId, scope, requestedAt } = job.data

  await logAuditEvent({ event: 'optout-processing-started', contactId, scope, requestedAt, startedAt: new Date() })

  await db.consentRecord.create({ data: { contactId, scope, granted: false, source: 'unsubscribe-link' } })
  await logAuditEvent({ event: 'optout-consent-record-created', contactId, scope })

  await emailPlatform.suppressContact(contactId)
  await logAuditEvent({ event: 'optout-esp-synced', contactId, scope, espConfirmedAt: new Date() })

  const processingMs = Date.now() - new Date(requestedAt).getTime()
  await logAuditEvent({ event: 'optout-processing-complete', contactId, scope, processingMs })
})

With requestedAt from the job payload and espConfirmedAt from the final log entry, you can compute the exact processing duration for any opt-out request and prove CAN-SPAM compliance on demand.