EV-Q25-01-sad-purge-verify

Terminal evidence for PCI DSS QSA audit. Timestamps in UTC.

=== Evidence Q25-01 — SAD purge dual (immediate + sweeper) implementado ===
Timestamp: 2026-08-01T16:30:00Z
Referencia: PCI DSS v4.0 Req 3.3.1

--- Source: backend/apps/tokenization-service/src/sad-purge/sad-purge.service.ts ---
Provider: SadPurgeService (Injectable, OnModuleInit)
Sweeper interval: 60s (configurable via TOKENIZATION_SAD_SWEEP_INTERVAL_MS)

--- Trigger points (grep purgeAfterAuth in tokenization.service.ts) ---
Line 190: purgeAfterAuth(dto.token, 'ttl_expired')
Line 202: purgeAfterAuth(dto.token, 'detokenize_consume')
Line 224: purgeAfterAuth(token, 'explicit_delete')
Line 244: purgeAfterAuth(token, 'post_auth')

--- Tests coverage ---
backend/apps/tokenization-service/test/sad-purge.service.spec.ts
  ✓ purgeAfterAuth revokes SAD + publishes purged event
  ✓ sweeper detects expired entries + purges
  ✓ sweeper guards against overlapping runs
  ✓ sweeper counts purged + errors

--- Kafka events emitted per purge ---
Topic: fintrix.security.sad.purged
Envelope: FintrixEventEnvelopeV1
Payload: { tokenId, reason: 'ttl_expired'|'detokenize_consume'|'explicit_delete'|'post_auth', timestamp }

---

Auto-generated evidence — do not edit. Regenerable via commands documented in the parent EVD document.