Database query performance is monitored

NIST AU-2 requires that systems log events necessary to support performance analysis. Database query performance is the most common hidden cause of SaaS slowdowns at scale: N+1 query patterns that execute in milliseconds against a development database with 100 rows execute in seconds against production with 100,000 rows. Without slow query monitoring, these regressions are invisible until P99 latency degrades or the database CPU spikes. Unlike application-level performance monitoring, query monitoring requires either ORM-level hooks or database-level configuration — the application server cannot observe query timing without instrumenting the database client directly.

Enable query logging at the ORM level with a duration threshold so only slow queries emit events — not every query.

For Prisma:

const prisma = new PrismaClient({
  log: [
    { emit: 'event', level: 'query' }
  ]
})
prisma.$on('query', (e) => {
  if (e.duration > 1000) { // queries slower than 1 second
    logger.warn(
      { query: e.query, duration: e.duration },
      'Slow query detected'
    )
  }
})

For Supabase, the Query Performance page in the Supabase dashboard shows slow queries automatically — check it after any deploy that touches database access patterns. No code changes required for Supabase's built-in query insights.