diff --git a/apps/api/.env.example b/apps/api/.env.example
index 2a2ebc2f..5c4065bf 100644
--- a/apps/api/.env.example
+++ b/apps/api/.env.example
@@ -13,6 +13,11 @@
 # per-key ApiKeyThrottlerGuard (no code change needed).
 API_KEYS='dev-local=abc123'
 
+# ── Logging (optional) ───────────────────────────────────────────────────────
+# LOG_HASH_KEY: key for the short hash that lets log lines about the same address be matched
+# without storing it. Unset, a random key is generated per process.
+# LOG_HASH_KEY=
+
 # ── Rate limiting (optional; per-API-key) ────────────────────────────────────
 # Defaults: 120 requests per 60000 ms. Override per environment if needed.
 # THROTTLE_LIMIT=120
diff --git a/apps/api/src/common/dto/error-response.dto.ts b/apps/api/src/common/dto/error-response.dto.ts
index 4f0e809c..f847b45b 100644
--- a/apps/api/src/common/dto/error-response.dto.ts
+++ b/apps/api/src/common/dto/error-response.dto.ts
@@ -16,6 +16,12 @@ export class ErrorBodyDto {
     description: "Extra structured context, present only when there is more to say.",
   })
   details?: unknown;
+
+  @ApiPropertyOptional({
+    description:
+      "The id of this request, also returned in the x-request-id header. Quote it when reporting a problem.",
+  })
+  requestId?: string;
 }
 
 export class ErrorResponseDto {
diff --git a/apps/api/src/common/json-logger.ts b/apps/api/src/common/json-logger.ts
new file mode 100644
index 00000000..86dc94ef
--- /dev/null
+++ b/apps/api/src/common/json-logger.ts
@@ -0,0 +1,79 @@
+import type { LoggerService } from "@nestjs/common";
+import { scrubValue } from "./log-privacy";
+import { currentRequestId, currentSensitiveLiterals } from "./request-context";
+
+type Severity = "DEBUG" | "INFO" | "WARNING" | "ERROR" | "CRITICAL";
+
+/**
+ * One JSON object per line on stdout, which Cloud Run forwards to Cloud Logging. `severity` is
+ * the field Cloud Logging reads to classify an entry; `message` becomes its text.
+ */
+export class JsonLogger implements LoggerService {
+  constructor(private readonly write: (line: string) => void = defaultWrite) {}
+
+  log(message: unknown, ...params: unknown[]): void {
+    this.emit("INFO", message, params);
+  }
+  warn(message: unknown, ...params: unknown[]): void {
+    this.emit("WARNING", message, params);
+  }
+  error(message: unknown, ...params: unknown[]): void {
+    this.emit("ERROR", message, params);
+  }
+  fatal(message: unknown, ...params: unknown[]): void {
+    this.emit("CRITICAL", message, params);
+  }
+  debug(message: unknown, ...params: unknown[]): void {
+    this.emit("DEBUG", message, params);
+  }
+  verbose(message: unknown, ...params: unknown[]): void {
+    this.emit("DEBUG", message, params);
+  }
+
+  private emit(severity: Severity, message: unknown, params: unknown[]): void {
+    const strings = params.filter((p): p is string => typeof p === "string");
+    const isFailure = severity === "ERROR" || severity === "CRITICAL";
+    // Nest appends the logger's context last; a failure may carry a stack before it.
+    const hasStack = isFailure && (strings.length > 1 || strings[0]?.includes("\n") === true);
+    const stack = hasStack ? strings[0] : undefined;
+    const context = hasStack && strings.length === 1 ? undefined : strings[strings.length - 1];
+
+    let text: string;
+    let stackText = stack;
+    let fields: Record<string, unknown> = {};
+    let trusted = false;
+    if (message instanceof Error) {
+      text = message.message;
+      stackText = stack ?? message.stack;
+    } else if (typeof message === "object" && message !== null) {
+      const { message: inner, ...rest } = message as Record<string, unknown>;
+      text = typeof inner === "string" ? inner : "";
+      fields = rest;
+      trusted = true;
+    } else {
+      text = String(message);
+    }
+
+    // A structured record is written by our own code (the access line), so it keeps its values;
+    // free text and stacks can carry what a request supplied and lose the request's memo.
+    const literals = [...currentSensitiveLiterals()];
+    const body = {
+      ...(scrubValue(fields, []) as Record<string, unknown>),
+      message: scrubValue(text, trusted ? [] : literals),
+      context,
+      stack: scrubValue(stackText, literals),
+    };
+    this.write(
+      JSON.stringify({
+        ...body,
+        severity,
+        time: new Date().toISOString(),
+        requestId: currentRequestId(),
+      })
+    );
+  }
+}
+
+function defaultWrite(line: string): void {
+  process.stdout.write(`${line}\n`);
+}
diff --git a/apps/api/src/common/log-privacy.ts b/apps/api/src/common/log-privacy.ts
new file mode 100644
index 00000000..aeec9cdb
--- /dev/null
+++ b/apps/api/src/common/log-privacy.ts
@@ -0,0 +1,53 @@
+import { createHmac, randomBytes } from "crypto";
+import { isCexAddress } from "@/lib/exchange-registry";
+
+const SECRET = /(?<![A-Z2-7])S[A-Z2-7]{55}(?![A-Z2-7])/g;
+const ADDRESS = /(?<![A-Z2-7])(?:M[A-Z2-7]{68}|[GC][A-Z2-7]{55})(?![A-Z2-7])/g;
+const BEARER = /Bearer\s+\S+/gi;
+const BLOB = /[A-Za-z0-9+/]{100,}={0,2}/g;
+
+const MIN_LITERAL_LENGTH = 3;
+
+const hashKey = process.env.LOG_HASH_KEY || randomBytes(32).toString("hex");
+
+function correlationHash(address: string): string {
+  return createHmac("sha256", hashKey).update(address).digest("hex").slice(0, 8);
+}
+
+function redactAddress(address: string): string {
+  if (isCexAddress(address)) return "[exchange]";
+  return `${address.slice(0, 4)}...${address.slice(-4)}~${correlationHash(address)}`;
+}
+
+/**
+ * The log privacy policy (docs/reference/logging-and-privacy.mdx), applied to the text of every
+ * value the logger writes: whatever a call site interpolates, no secret-shaped string, full
+ * address, token or XDR-sized blob leaves the process. `literals` are values the request itself
+ * carried that must never appear, such as a deposit memo.
+ *
+ * It runs on values before they are serialized, never on the JSON line: a user-chosen memo such
+ * as `","` or `severity` would otherwise rewrite the line's own structure.
+ */
+export function scrubText(text: string, literals: Iterable<string> = []): string {
+  let out = text;
+  for (const literal of literals) {
+    if (literal.length >= MIN_LITERAL_LENGTH) out = out.split(literal).join("[memo]");
+  }
+  return out
+    .replace(SECRET, "[redacted-secret]")
+    .replace(BEARER, "Bearer [redacted]")
+    .replace(ADDRESS, redactAddress)
+    .replace(BLOB, "[redacted]");
+}
+
+/** `scrubText` over every string in a JSON-shaped value; object keys are left alone. */
+export function scrubValue(value: unknown, literals: readonly string[]): unknown {
+  if (typeof value === "string") return scrubText(value, literals);
+  if (Array.isArray(value)) return value.map((item) => scrubValue(item, literals));
+  if (typeof value === "object" && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, inner]) => [key, scrubValue(inner, literals)])
+    );
+  }
+  return value;
+}
diff --git a/apps/api/src/common/request-context.ts b/apps/api/src/common/request-context.ts
new file mode 100644
index 00000000..2f4b7553
--- /dev/null
+++ b/apps/api/src/common/request-context.ts
@@ -0,0 +1,108 @@
+import { AsyncLocalStorage } from "async_hooks";
+import { randomUUID } from "crypto";
+import { Logger } from "@nestjs/common";
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+import { xdr } from "@stellar/stellar-sdk";
+import type { AuthedRequest } from "@/auth/api-key.guard";
+
+export const REQUEST_ID_HEADER = "x-request-id";
+
+interface RequestContext {
+  requestId: string;
+  sensitive: Set<string>;
+}
+
+const storage = new AsyncLocalStorage<RequestContext>();
+
+export function currentRequestId(): string | undefined {
+  return storage.getStore()?.requestId;
+}
+
+export function currentSensitiveLiterals(): Iterable<string> {
+  return storage.getStore()?.sensitive ?? [];
+}
+
+/** Marks a value the current request carried (a deposit memo) as never to be logged. */
+export function markSensitive(value: unknown): void {
+  if (typeof value === "string" && value.length > 0) storage.getStore()?.sensitive.add(value);
+}
+
+function withRequestId(body: unknown, requestId: string): unknown {
+  if (typeof body !== "object" || body === null || !("error" in body)) return body;
+  const { error } = body as { error: unknown };
+  if (typeof error !== "object" || error === null || Array.isArray(error)) return body;
+  return { ...body, error: { ...error, requestId } };
+}
+
+function severityMethod(status: number): "log" | "warn" | "error" {
+  if (status >= 500) return "error";
+  if (status >= 400) return "warn";
+  return "log";
+}
+
+/**
+ * Gives every request an id before anything that can answer it, sets the headers every
+ * response carries (`x-request-id`, `Cache-Control: no-store`), copies the id into any error
+ * envelope, and writes one access line when the response finishes.
+ *
+ * The id is always generated here: a caller-supplied one would let a client forge or inject
+ * into the log line it is meant to be matched against. The access line carries the matched route
+ * pattern, never the raw path, because paths hold account addresses.
+ */
+export function requestContextMiddleware(): RequestHandler {
+  const logger = new Logger("http");
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const requestId = randomUUID();
+    const startedAt = process.hrtime.bigint();
+    res.setHeader(REQUEST_ID_HEADER, requestId);
+    res.setHeader("Cache-Control", "no-store");
+
+    const json = res.json.bind(res);
+    res.json = ((body?: unknown) =>
+      json(res.statusCode >= 400 ? withRequestId(body, requestId) : body)) as Response["json"];
+
+    res.on("finish", () => {
+      if (req.path === "/health") return;
+      const params = req.params as Record<string, string | undefined> | undefined;
+      logger[severityMethod(res.statusCode)]({
+        message: "request",
+        route: req.route ? `${req.baseUrl}${String(req.route.path)}` : "unrouted",
+        status: res.statusCode,
+        latencyMs: Math.round(Number(process.hrtime.bigint() - startedAt) / 1e6),
+        keyLabel: (req as AuthedRequest).apiKeyLabel,
+        network: params?.network,
+      });
+    });
+
+    storage.run({ requestId, sensitive: new Set() }, next);
+  };
+}
+
+function memoOfEnvelope(signedXdr: string): string | undefined {
+  try {
+    const envelope = xdr.TransactionEnvelope.fromXDR(signedXdr, "base64");
+    const tx =
+      envelope.switch().name === "envelopeTypeTxFeeBump"
+        ? envelope.feeBump().tx().innerTx().v1().tx()
+        : envelope.v1().tx();
+    const memo = tx.memo();
+    if (memo.switch().name === "memoText") return memo.text().toString("utf8");
+    if (memo.switch().name === "memoId") return memo.id().toString();
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}
+
+/** After body parsing: the memo is the one body value that identifies a deposit, so it is
+ *  registered for removal from every line the rest of the request writes, whether it arrived as a
+ *  field or inside a signed envelope. */
+export const registerRequestSecrets: RequestHandler = (req, _res, next) => {
+  const body: unknown = req.body;
+  if (typeof body === "object" && body !== null) {
+    const { memo, signedXdr } = body as { memo?: unknown; signedXdr?: unknown };
+    markSensitive(memo);
+    if (typeof signedXdr === "string") markSensitive(memoOfEnvelope(signedXdr));
+  }
+  next();
+};
diff --git a/apps/api/src/configure-app.ts b/apps/api/src/configure-app.ts
index cc456bb6..1eb06915 100644
--- a/apps/api/src/configure-app.ts
+++ b/apps/api/src/configure-app.ts
@@ -1,9 +1,11 @@
-import type { INestApplication } from "@nestjs/common";
+import type { INestApplication, LoggerService } from "@nestjs/common";
 import type { ErrorCode } from "@lumenwipe/types";
 import { json } from "express";
-import type { ErrorRequestHandler, NextFunction, Request, RequestHandler, Response } from "express";
+import type { ErrorRequestHandler, RequestHandler } from "express";
 import { RateLimiter } from "./auth/rate-limiter";
 import { ErrorEnvelopeFilter } from "./common/error-envelope.filter";
+import { JsonLogger } from "./common/json-logger";
+import { registerRequestSecrets, requestContextMiddleware } from "./common/request-context";
 
 export const JSON_BODY_LIMIT = "100kb";
 
@@ -40,7 +42,10 @@ const BODY_PARSER_ERRORS: Record<string, { status: number; code: ErrorCode; mess
  * we own the JSON error contract: a malformed body must return the original
  * routes' shape, not Nest's default `{ statusCode, message, error }`.
  */
-export function configureApp(app: INestApplication): void {
+export function configureApp(
+  app: INestApplication,
+  logger: LoggerService = new JsonLogger()
+): void {
   // Cloud Run terminates TLS and proxies every request through its own frontend - without this,
   // Express's req.ip reports that proxy's address for every request, not the real caller's, so
   // RateLimiter's per-IP fallback (unauthenticated requests, which carry no API key to
@@ -49,13 +54,14 @@ export function configureApp(app: INestApplication): void {
   // trusting it to report the real client in X-Forwarded-For is safe here.
   app.getHttpAdapter().getInstance().set("trust proxy", true);
 
-  // Every response is dynamic and non-cacheable (account state, plans, unsigned
-  // XDR, mediator co-signatures) - no client, proxy, or CDN should store any of
-  // it, success or error. First, so the limiter's own 429 and 500 carry it too.
-  app.use((_req: Request, res: Response, next: NextFunction) => {
-    res.setHeader("Cache-Control", "no-store");
-    next();
-  });
+  app.useLogger(logger);
+
+  // First, ahead of the rate limiter, body parsing and authentication, so the limiter's own 429,
+  // a 401 and a body error all carry x-request-id. Also sets Cache-Control: no-store: every
+  // response is dynamic and non-cacheable (account state, plans, unsigned XDR, mediator
+  // co-signatures), success or error. Order: request context, rate limiter, filters, body
+  // parser, body-error mapping, body normalization, secret registration.
+  app.use(requestContextMiddleware());
 
   // Ahead of body parsing, routing and authentication, so the budget is spent and
   // reported on every response, including a 404 or a rejected body.
@@ -111,4 +117,5 @@ export function configureApp(app: INestApplication): void {
     next();
   };
   app.use(normalizeBody);
+  app.use(registerRequestSecrets);
 }
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index 8ac1695d..cc0f0332 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -4,6 +4,7 @@ import { Logger } from "@nestjs/common";
 import { NestFactory } from "@nestjs/core";
 import { SwaggerModule } from "@nestjs/swagger";
 import { AppModule } from "./app.module";
+import { JsonLogger } from "./common/json-logger";
 import { configureApp } from "./configure-app";
 import { createOpenApiDocument } from "./openapi";
 import { checkEnv, formatEnvFailure } from "./config/validate-env";
@@ -20,7 +21,7 @@ async function bootstrap(): Promise<void> {
     process.exit(1);
   }
 
-  const app = await NestFactory.create(AppModule, { bodyParser: false });
+  const app = await NestFactory.create(AppModule, { bodyParser: false, logger: new JsonLogger() });
   const bootLogger = new Logger("bootstrap");
   // Logged, not fatal: each of these disables a path rather than the service, and the operator
   // should learn it here rather than from a user hitting the disabled path.
diff --git a/apps/api/tests/e2e/body-handling.e2e.test.ts b/apps/api/tests/e2e/body-handling.e2e.test.ts
index c9d5e784..0f5fd8dc 100644
--- a/apps/api/tests/e2e/body-handling.e2e.test.ts
+++ b/apps/api/tests/e2e/body-handling.e2e.test.ts
@@ -4,6 +4,7 @@ import { Test } from "@nestjs/testing";
 import request from "supertest";
 import { Keypair, Networks, TransactionBuilder, Account, Operation } from "@stellar/stellar-sdk";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp, JSON_BODY_LIMIT } from "@/configure-app";
 
 const KEY = "e2e_test_key";
@@ -39,7 +40,7 @@ beforeAll(async () => {
   process.env.API_KEYS = `test=${KEY}`;
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   http = app.getHttpServer();
 });
@@ -92,7 +93,7 @@ describe.each(POST_ROUTES)("POST %s", (route) => {
     const res = await post(route);
     expect(res.body.error.code).toBeString();
     expect(res.body.error.code).not.toBe("internal_error");
-    expect(spy).not.toHaveBeenCalled();
+    expect(spy.mock.calls.filter(([message]) => typeof message === "string")).toEqual([]);
     spy.mockRestore();
   });
 });
diff --git a/apps/api/tests/e2e/contract.e2e.test.ts b/apps/api/tests/e2e/contract.e2e.test.ts
index e77c48e4..3764beda 100644
--- a/apps/api/tests/e2e/contract.e2e.test.ts
+++ b/apps/api/tests/e2e/contract.e2e.test.ts
@@ -4,6 +4,7 @@ import { Test } from "@nestjs/testing";
 import request from "supertest";
 import { Keypair } from "@stellar/stellar-sdk";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 import { API_VERSION } from "@/openapi";
 
@@ -24,7 +25,7 @@ beforeAll(async () => {
   process.env.API_KEYS = `test=${KEY}`;
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   http = app.getHttpServer();
 });
@@ -59,7 +60,7 @@ test("the service index at / is public and points at the docs", async () => {
 test("an authenticated route without a key is rejected 401", async () => {
   const res = await request(http).get("/testnet/account/NOPE");
   expect(res.status).toBe(401);
-  expect(res.body).toEqual({
+  expect(res.body).toMatchObject({
     error: { code: "unauthorized", message: "A valid API key is required." },
   });
 });
@@ -67,7 +68,7 @@ test("an authenticated route without a key is rejected 401", async () => {
 test("an authenticated route with an unknown key is rejected 401", async () => {
   const res = await request(http).get("/testnet/account/NOPE").set("Authorization", "Bearer nope");
   expect(res.status).toBe(401);
-  expect(res.body).toEqual({
+  expect(res.body).toMatchObject({
     error: { code: "unauthorized", message: "A valid API key is required." },
   });
 });
@@ -77,13 +78,15 @@ test("an authenticated route with an unknown key is rejected 401", async () => {
 test("close/plan rejects an invalid network with the v1 error shape", async () => {
   const res = await authPost("/v1/badnet/close/plan").send({});
   expect(res.status).toBe(400);
-  expect(res.body).toEqual({ error: { code: "invalid_network", message: "Invalid network." } });
+  expect(res.body).toMatchObject({
+    error: { code: "invalid_network", message: "Invalid network." },
+  });
 });
 
 test("close/plan rejects a missing source", async () => {
   const res = await authPost("/v1/testnet/close/plan").send({});
   expect(res.status).toBe(400);
-  expect(res.body).toEqual({
+  expect(res.body).toMatchObject({
     error: { code: "invalid_source", message: "A valid source account (G...) is required." },
   });
 });
@@ -91,7 +94,9 @@ test("close/plan rejects a missing source", async () => {
 test("close/batch-plan rejects an invalid network with the v1 error shape", async () => {
   const res = await authPost("/v1/badnet/close/batch-plan").send({ addresses: [] });
   expect(res.status).toBe(400);
-  expect(res.body).toEqual({ error: { code: "invalid_network", message: "Invalid network." } });
+  expect(res.body).toMatchObject({
+    error: { code: "invalid_network", message: "Invalid network." },
+  });
 });
 
 test("close/batch-plan rejects an empty addresses array", async () => {
@@ -133,7 +138,7 @@ test("close/batch-plan rejects an invalid destination", async () => {
 test("submit rejects a missing signedXdr", async () => {
   const res = await authPost("/v1/testnet/submit").send({});
   expect(res.status).toBe(400);
-  expect(res.body).toEqual({
+  expect(res.body).toMatchObject({
     error: {
       code: "invalid_signed_xdr",
       message: "A signed transaction envelope (signedXdr) is required.",
@@ -181,7 +186,7 @@ test("malformed JSON on a v1 endpoint returns the invalid_body contract", async
     .set("Content-Type", "application/json")
     .send('{ "source": ');
   expect(res.status).toBe(400);
-  expect(res.body).toEqual({
+  expect(res.body).toMatchObject({
     error: { code: "invalid_body", message: "Request body must be valid JSON." },
   });
 });
@@ -357,7 +362,7 @@ test("close/transactions rejects a text memo over 28 bytes with 422 (before any
     memo: "x".repeat(29),
   });
   expect(res.status).toBe(422);
-  expect(res.body).toEqual({
+  expect(res.body).toMatchObject({
     error: { code: "invalid_memo", message: "A text memo must be at most 28 bytes." },
   });
 });
@@ -500,7 +505,9 @@ test("the stats feed is public and covers 365 days", async () => {
 test("stats reject an invalid network", async () => {
   const res = await request(http).get("/v1/badnet/stats");
   expect(res.status).toBe(400);
-  expect(res.body).toEqual({ error: { code: "invalid_network", message: "Invalid network." } });
+  expect(res.body).toMatchObject({
+    error: { code: "invalid_network", message: "Invalid network." },
+  });
 });
 
 test("recording a close requires an API key", async () => {
diff --git a/apps/api/tests/e2e/log-privacy.e2e.test.ts b/apps/api/tests/e2e/log-privacy.e2e.test.ts
new file mode 100644
index 00000000..8c826690
--- /dev/null
+++ b/apps/api/tests/e2e/log-privacy.e2e.test.ts
@@ -0,0 +1,152 @@
+import { afterAll, afterEach, beforeAll, expect, spyOn, test } from "bun:test";
+import type { INestApplication } from "@nestjs/common";
+import { Test } from "@nestjs/testing";
+import request from "supertest";
+import {
+  Account,
+  Keypair,
+  Memo,
+  Networks,
+  Operation,
+  TransactionBuilder,
+} from "@stellar/stellar-sdk";
+import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
+import { configureApp } from "@/configure-app";
+import * as accountPlan from "@/lib/close-api/account-plan";
+import * as readAccount from "@/lib/close-api/read-account";
+import { servedRegistry } from "@/lib/exchange-registry";
+import * as submitModule from "@/lib/stellar/submit";
+
+const KEY = "e2e_test_key";
+const PLACEHOLDER_SECRET = `S${"A".repeat(55)}`;
+const MEMO = "4815162342";
+const EXCHANGE = servedRegistry().entries.find((e) => e.requiresMediator && e.requiresMemo)!;
+const SOURCE = Keypair.random().publicKey();
+const OTHER = Keypair.random().publicKey();
+const SIGNED_XDR = (() => {
+  const signer = Keypair.random();
+  const tx = new TransactionBuilder(new Account(signer.publicKey(), "100"), {
+    fee: "100",
+    networkPassphrase: Networks.TESTNET,
+  })
+    .addOperation(Operation.accountMerge({ destination: EXCHANGE.address }))
+    .addMemo(Memo.id(MEMO))
+    .setTimeout(30)
+    .build();
+  tx.sign(signer);
+  return tx.toXDR();
+})();
+
+let app: INestApplication;
+let http: ReturnType<INestApplication["getHttpServer"]>;
+const written: string[] = [];
+
+beforeAll(async () => {
+  process.env.API_KEYS = `test=${KEY}`;
+  const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
+  app = moduleRef.createNestApplication({ bodyParser: false });
+  configureApp(app, new JsonLogger((line) => written.push(line)));
+  await app.init();
+  http = app.getHttpServer();
+});
+
+afterEach(() => {
+  spyOn(accountPlan, "buildAccountPlan").mockRestore();
+  spyOn(readAccount, "readAccountState").mockRestore();
+  spyOn(submitModule, "submitAndWait").mockRestore();
+});
+
+afterAll(async () => {
+  await app.close();
+});
+
+const post = (path: string, ip: string) =>
+  request(http).post(path).set("Authorization", `Bearer ${KEY}`).set("X-Forwarded-For", ip);
+
+test("an exchange close that fails at every step logs no address, memo, secret or body", async () => {
+  const leak = `${SOURCE} -> ${EXCHANGE.address} memo ${MEMO} key ${PLACEHOLDER_SECRET} ${SIGNED_XDR}`;
+  spyOn(accountPlan, "buildAccountPlan").mockRejectedValue(new Error(leak));
+  spyOn(readAccount, "readAccountState").mockRejectedValue(new Error(leak));
+  spyOn(submitModule, "submitAndWait").mockRejectedValue(new Error(leak));
+
+  const plan = await post("/v1/testnet/close/plan", "203.0.113.20").send({
+    source: SOURCE,
+    destination: EXCHANGE.address,
+    memo: MEMO,
+  });
+  const transactions = await post("/v1/testnet/close/transactions", "203.0.113.21").send({
+    source: SOURCE,
+    destination: EXCHANGE.address,
+    memo: MEMO,
+  });
+  const submit = await post("/v1/testnet/submit", "203.0.113.22").send({ signedXdr: SIGNED_XDR });
+  expect([plan.status, transactions.status, submit.status]).toEqual([500, 500, 502]);
+  for (const res of [plan, transactions, submit]) {
+    expect(JSON.stringify(res.body)).not.toContain(EXCHANGE.address);
+    expect(res.body.error.requestId).toBe(res.headers["x-request-id"]);
+  }
+
+  const lines = written;
+  const records = lines.map((l) => JSON.parse(l) as Record<string, unknown>);
+  const text = lines.join("\n");
+
+  expect(records.some((r) => r.severity === "ERROR")).toBe(true);
+  expect(text).toContain("[exchange]");
+  expect(text).toContain("[memo]");
+  expect(text).toContain(`${SOURCE.slice(0, 4)}...${SOURCE.slice(-4)}~`);
+
+  expect(text).not.toMatch(/[GCM][A-Z2-7]{55}/);
+  expect(text).not.toMatch(/S[A-Z2-7]{55}/);
+  expect(text).not.toContain(EXCHANGE.address.slice(0, 8));
+  expect(text).not.toContain(EXCHANGE.address.slice(-8));
+  expect(text).not.toContain(`${EXCHANGE.address.slice(0, 4)}...${EXCHANGE.address.slice(-4)}`);
+  expect(text).not.toContain(MEMO);
+  expect(text).not.toContain(SIGNED_XDR);
+  expect(text).not.toContain(OTHER);
+});
+
+test("access lines name the route pattern and never the raw path", async () => {
+  written.length = 0;
+  await request(http)
+    .get(`/testnet/account/${OTHER}`)
+    .set("Authorization", `Bearer ${KEY}`)
+    .set("X-Forwarded-For", "203.0.113.23");
+  const access = written
+    .map((l) => JSON.parse(l) as Record<string, unknown>)
+    .find((r) => r.message === "request");
+  expect(access).toMatchObject({
+    route: "/:network/account/:address",
+    keyLabel: "test",
+    network: "testnet",
+  });
+  expect(JSON.stringify(access)).not.toContain(OTHER);
+  expect(typeof access?.latencyMs).toBe("number");
+  expect(access).not.toHaveProperty("ip");
+});
+
+test.each(['","', '":"', '{"s', "severity", "message", "request", 'a\\b"c'])(
+  "the memo %p never breaks a log line or rewrites its keys",
+  async (memo) => {
+    written.length = 0;
+    spyOn(readAccount, "readAccountState").mockRejectedValue(new Error(`failed for memo ${memo}`));
+    const res = await post("/v1/testnet/close/transactions", "203.0.113.30").send({
+      source: SOURCE,
+      destination: EXCHANGE.address,
+      memo,
+    });
+    expect(res.status).toBeGreaterThanOrEqual(400);
+
+    const records = written.map((line) => JSON.parse(line) as Record<string, unknown>);
+    expect(records.length).toBeGreaterThan(0);
+    for (const record of records) {
+      expect(Object.keys(record)).toEqual(expect.arrayContaining(["severity", "time", "message"]));
+      expect(["INFO", "WARNING", "ERROR"]).toContain(record.severity as string);
+      expect(typeof record.requestId).toBe("string");
+    }
+    const failure = records.find((r) => r.context === "CloseController");
+    expect(failure?.message).toBe("close/transactions failed");
+    expect(String(failure?.stack ?? "")).not.toContain(memo);
+    expect(records.some((r) => r.message === "request" && r.status === res.status)).toBe(true);
+  }
+);
diff --git a/apps/api/tests/e2e/openapi-drift.e2e.test.ts b/apps/api/tests/e2e/openapi-drift.e2e.test.ts
index d46d642e..5d54a574 100644
--- a/apps/api/tests/e2e/openapi-drift.e2e.test.ts
+++ b/apps/api/tests/e2e/openapi-drift.e2e.test.ts
@@ -6,6 +6,7 @@ import { Test } from "@nestjs/testing";
 import SwaggerParser from "@apidevtools/swagger-parser";
 import type { OpenAPIObject } from "@nestjs/swagger";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 import { ERROR_CODES } from "@/common/error-codes";
 import {
@@ -29,7 +30,7 @@ beforeAll(async () => {
   process.env.API_KEYS = "test=e2e_test_key";
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   spec = createOpenApiDocument(app);
   generated = serializeOpenApiDocument(spec);
diff --git a/apps/api/tests/e2e/openapi.e2e.test.ts b/apps/api/tests/e2e/openapi.e2e.test.ts
index e05c4fff..1329b095 100644
--- a/apps/api/tests/e2e/openapi.e2e.test.ts
+++ b/apps/api/tests/e2e/openapi.e2e.test.ts
@@ -3,6 +3,7 @@ import type { INestApplication } from "@nestjs/common";
 import { Test } from "@nestjs/testing";
 import type { OpenAPIObject } from "@nestjs/swagger";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 import { createOpenApiDocument } from "@/openapi";
 
@@ -13,7 +14,7 @@ beforeAll(async () => {
   process.env.API_KEYS = "test=e2e_test_key";
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   spec = createOpenApiDocument(app);
 });
diff --git a/apps/api/tests/e2e/param-validation.e2e.test.ts b/apps/api/tests/e2e/param-validation.e2e.test.ts
index baa673d8..c11b8e2c 100644
--- a/apps/api/tests/e2e/param-validation.e2e.test.ts
+++ b/apps/api/tests/e2e/param-validation.e2e.test.ts
@@ -4,6 +4,7 @@ import { Test } from "@nestjs/testing";
 import request from "supertest";
 import { Keypair } from "@stellar/stellar-sdk";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 
 const KEY = "e2e_test_key";
@@ -15,7 +16,7 @@ beforeAll(async () => {
   process.env.API_KEYS = `test=${KEY}`;
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
 });
 
@@ -35,7 +36,9 @@ for (const route of ADDRESS_ROUTES) {
       .get(route.path("nope", "x"))
       .set("Authorization", `Bearer ${KEY}`);
     expect(res.status).toBe(400);
-    expect(res.body).toEqual({ error: { code: "invalid_network", message: "Invalid network" } });
+    expect(res.body).toMatchObject({
+      error: { code: "invalid_network", message: "Invalid network" },
+    });
   });
 
   test(`${route.path("{network}", "{address}")} rejects only the address on a valid network`, async () => {
@@ -43,7 +46,7 @@ for (const route of ADDRESS_ROUTES) {
       .get(route.path("testnet", "x"))
       .set("Authorization", `Bearer ${KEY}`);
     expect(res.status).toBe(400);
-    expect(res.body).toEqual({ error: { code: "invalid_address", message: route.message } });
+    expect(res.body).toMatchObject({ error: { code: "invalid_address", message: route.message } });
   });
 }
 
@@ -52,5 +55,7 @@ test("a bad network on a close route keeps its trailing-period message", async (
     .post("/v1/nope/close/plan")
     .set("Authorization", `Bearer ${KEY}`)
     .send({ source: ADDRESS });
-  expect(res.body).toEqual({ error: { code: "invalid_network", message: "Invalid network." } });
+  expect(res.body).toMatchObject({
+    error: { code: "invalid_network", message: "Invalid network." },
+  });
 });
diff --git a/apps/api/tests/e2e/rate-limit-headers.e2e.test.ts b/apps/api/tests/e2e/rate-limit-headers.e2e.test.ts
index a4eb6b66..cdf918d6 100644
--- a/apps/api/tests/e2e/rate-limit-headers.e2e.test.ts
+++ b/apps/api/tests/e2e/rate-limit-headers.e2e.test.ts
@@ -4,6 +4,7 @@ import { Test } from "@nestjs/testing";
 import request from "supertest";
 import { AppModule } from "@/app.module";
 import { RateLimiter } from "@/auth/rate-limiter";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 
 const KEY = "e2e_test_key";
@@ -17,7 +18,7 @@ beforeAll(async () => {
   delete process.env.INTEGRATOR_SESSION_SECRET;
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   http = app.getHttpServer();
 });
@@ -132,7 +133,7 @@ test("a 429 is the same whether the key is valid or not", async () => {
     }
     const res = await request(http).get("/testnet/account/G").set("Authorization", `Bearer ${key}`);
     expect(res.status).toBe(429);
-    bodies.push(res.body);
+    bodies.push({ ...res.body.error, requestId: undefined });
   }
   expect(bodies[0]).toEqual(bodies[1]);
 }, 30_000);
@@ -186,7 +187,7 @@ test("a limiter failure answers 500 and is non-cacheable", async () => {
   try {
     const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
     const broken = moduleRef.createNestApplication({ bodyParser: false });
-    configureApp(broken);
+    configureApp(broken, new JsonLogger(() => undefined));
     await broken.init();
     const res = await request(broken.getHttpServer()).get("/no/such/route");
     expect(res.status).toBe(500);
diff --git a/apps/api/tests/e2e/request-id.e2e.test.ts b/apps/api/tests/e2e/request-id.e2e.test.ts
new file mode 100644
index 00000000..130c0da3
--- /dev/null
+++ b/apps/api/tests/e2e/request-id.e2e.test.ts
@@ -0,0 +1,113 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import type { INestApplication } from "@nestjs/common";
+import { Test } from "@nestjs/testing";
+import request from "supertest";
+import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
+import { configureApp } from "@/configure-app";
+
+const KEY = "e2e_test_key";
+const LIMIT = 120;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+let app: INestApplication;
+let http: ReturnType<INestApplication["getHttpServer"]>;
+
+beforeAll(async () => {
+  process.env.API_KEYS = `test=${KEY}`;
+  delete process.env.INTEGRATOR_SESSION_SECRET;
+  const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
+  app = moduleRef.createNestApplication({ bodyParser: false });
+  configureApp(app, new JsonLogger(() => undefined));
+  await app.init();
+  http = app.getHttpServer();
+});
+
+afterAll(async () => {
+  await app.close();
+});
+
+const ip = (address: string) => ({ "X-Forwarded-For": address });
+
+function expectIdentified(res: request.Response): string {
+  const id = res.headers["x-request-id"];
+  expect(id).toMatch(UUID);
+  expect(res.headers["cache-control"]).toBe("no-store");
+  expect(res.headers["ratelimit-limit"]).toBe(String(LIMIT));
+  expect(res.headers["x-ratelimit-limit"]).toBe(String(LIMIT));
+  expect(res.body.error.requestId).toBe(id);
+  return id as string;
+}
+
+test("a 401 carries the request id in the header and the envelope, with no-store and the budget", async () => {
+  const res = await request(http).get("/testnet/account/NOPE").set(ip("203.0.113.1"));
+  expect(res.status).toBe(401);
+  expect(res.body.error.message).toBe("A valid API key is required.");
+  expectIdentified(res);
+});
+
+test("a 429 from the limiter carries the request id, no-store and the budget headers", async () => {
+  const caller = ip("203.0.113.2");
+  for (let i = 0; i < LIMIT; i++) await request(http).get("/testnet/account/G").set(caller);
+  const blocked = await request(http).get("/testnet/account/G").set(caller);
+  expect(blocked.status).toBe(429);
+  expect(blocked.headers["retry-after"]).toBeDefined();
+  expectIdentified(blocked);
+}, 20_000);
+
+test("404, a malformed body and an oversize body carry it too", async () => {
+  const unknown = await request(http)
+    .get("/no/such/route")
+    .set(ip("203.0.113.3"))
+    .set("Authorization", `Bearer ${KEY}`);
+  expect(unknown.status).toBe(404);
+  expectIdentified(unknown);
+
+  const malformed = await request(http)
+    .post("/v1/testnet/close/plan")
+    .set(ip("203.0.113.4"))
+    .set("Authorization", `Bearer ${KEY}`)
+    .set("Content-Type", "application/json")
+    .send("{not json");
+  expect(malformed.status).toBe(400);
+  expectIdentified(malformed);
+
+  const oversize = await request(http)
+    .post("/v1/testnet/close/plan")
+    .set(ip("203.0.113.5"))
+    .set("Authorization", `Bearer ${KEY}`)
+    .set("Content-Type", "application/json")
+    .send(JSON.stringify({ pad: "x".repeat(200_000) }));
+  expect(oversize.status).toBe(413);
+  expectIdentified(oversize);
+});
+
+test("a controller error carries it, and a success carries the header without an envelope", async () => {
+  const invalid = await request(http)
+    .post("/v1/badnet/close/plan")
+    .set(ip("203.0.113.6"))
+    .set("Authorization", `Bearer ${KEY}`)
+    .send({});
+  expect(invalid.status).toBe(400);
+  expect(invalid.body.error.code).toBe("invalid_network");
+  expectIdentified(invalid);
+
+  const ok = await request(http).get("/health").set(ip("203.0.113.7"));
+  expect(ok.status).toBe(200);
+  expect(ok.headers["x-request-id"]).toMatch(UUID);
+  expect(ok.headers["cache-control"]).toBe("no-store");
+  expect(ok.body.error).toBeUndefined();
+});
+
+test("every request gets its own id and a client-supplied one is ignored", async () => {
+  const a = await request(http).get("/health").set("X-Request-Id", "client-chosen-id");
+  const b = await request(http).get("/health");
+  expect(a.headers["x-request-id"]).toMatch(UUID);
+  expect(a.headers["x-request-id"]).not.toBe(b.headers["x-request-id"]);
+  const c = await request(http)
+    .get("/testnet/account/NOPE")
+    .set(ip("203.0.113.8"))
+    .set("X-Request-Id", "client-chosen-id");
+  expect(c.body.error.requestId).toMatch(UUID);
+  expect(c.headers["x-request-id"]).toBe(c.body.error.requestId);
+});
diff --git a/apps/api/tests/e2e/spec-errors.e2e.test.ts b/apps/api/tests/e2e/spec-errors.e2e.test.ts
index 5975dfd4..76e7c58d 100644
--- a/apps/api/tests/e2e/spec-errors.e2e.test.ts
+++ b/apps/api/tests/e2e/spec-errors.e2e.test.ts
@@ -4,6 +4,7 @@ import type { OpenAPIObject } from "@nestjs/swagger";
 import { Test } from "@nestjs/testing";
 import request from "supertest";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 import { createOpenApiDocument } from "@/openapi";
 
@@ -27,7 +28,7 @@ beforeAll(async () => {
   delete process.env.INTEGRATOR_SESSION_SECRET;
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   http = app.getHttpServer();
   spec = createOpenApiDocument(app);
diff --git a/apps/api/tests/e2e/unauthenticated-throttle.e2e.test.ts b/apps/api/tests/e2e/unauthenticated-throttle.e2e.test.ts
index b7cfdeb7..97e6cc43 100644
--- a/apps/api/tests/e2e/unauthenticated-throttle.e2e.test.ts
+++ b/apps/api/tests/e2e/unauthenticated-throttle.e2e.test.ts
@@ -3,6 +3,7 @@ import type { INestApplication } from "@nestjs/common";
 import { Test } from "@nestjs/testing";
 import request from "supertest";
 import { AppModule } from "@/app.module";
+import { JsonLogger } from "@/common/json-logger";
 import { configureApp } from "@/configure-app";
 
 // Coverage for #59: a request with no API key (or a wrong one) used to be rejected with 401
@@ -26,7 +27,7 @@ beforeAll(async () => {
   process.env.API_KEYS = "test=real_key_unused_here";
   const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
   app = moduleRef.createNestApplication({ bodyParser: false });
-  configureApp(app);
+  configureApp(app, new JsonLogger(() => undefined));
   await app.init();
   http = app.getHttpServer();
 });
diff --git a/apps/api/tests/unit/json-logger.test.ts b/apps/api/tests/unit/json-logger.test.ts
new file mode 100644
index 00000000..1ab531c2
--- /dev/null
+++ b/apps/api/tests/unit/json-logger.test.ts
@@ -0,0 +1,69 @@
+import { expect, test } from "bun:test";
+import { Keypair } from "@stellar/stellar-sdk";
+import { JsonLogger } from "@/common/json-logger";
+import { scrubText } from "@/common/log-privacy";
+import { servedRegistry } from "@/lib/exchange-registry";
+
+const PLACEHOLDER_SECRET = `S${"A".repeat(55)}`;
+
+function capture(): { logger: JsonLogger; lines: string[] } {
+  const lines: string[] = [];
+  return { logger: new JsonLogger((line) => lines.push(line)), lines };
+}
+
+test("every line is one JSON object with a Cloud Logging severity", () => {
+  const { logger, lines } = capture();
+  logger.log("started", "Boot");
+  logger.warn("careful", "Boot");
+  logger.error("failed", "Error: boom\n    at x (y.ts:1:1)", "Boot");
+  logger.debug("detail");
+  logger.fatal("dead");
+  const parsed = lines.map((l) => JSON.parse(l) as Record<string, unknown>);
+  expect(parsed.map((p) => p.severity)).toEqual(["INFO", "WARNING", "ERROR", "DEBUG", "CRITICAL"]);
+  expect(parsed[0]).toMatchObject({ message: "started", context: "Boot" });
+  expect(parsed[2]).toMatchObject({ context: "Boot", stack: "Error: boom\n    at x (y.ts:1:1)" });
+  expect(lines.every((l) => !l.includes("\n"))).toBe(true);
+});
+
+test("structured fields are merged and cannot override the severity", () => {
+  const { logger, lines } = capture();
+  logger.log({ message: "request", status: 200, severity: "ERROR" });
+  expect(JSON.parse(lines[0]!)).toMatchObject({
+    message: "request",
+    status: 200,
+    severity: "INFO",
+  });
+});
+
+test("an address is cut to four and four characters plus a stable keyed hash", () => {
+  const address = Keypair.random().publicKey();
+  const other = Keypair.random().publicKey();
+  const out = scrubText(`read ${address} then ${address} and ${other}`);
+  expect(out).not.toContain(address);
+  const shown = out.match(/G[A-Z2-7]{3}\.\.\.[A-Z2-7]{4}~[0-9a-f]{8}/g) ?? [];
+  expect(shown).toHaveLength(3);
+  expect(shown[0]!.startsWith(`${address.slice(0, 4)}...${address.slice(-4)}~`)).toBe(true);
+  expect(shown[1]).toBe(shown[0]!);
+  expect(shown[2]).not.toBe(shown[0]!);
+});
+
+test("an exchange deposit address becomes a fixed token with no prefix suffix or hash", () => {
+  const exchange = servedRegistry().entries[0]!.address;
+  const out = scrubText(`destination ${exchange}`);
+  expect(out).toBe("destination [exchange]");
+});
+
+test("secret-shaped strings, bearer tokens and XDR-sized blobs never survive", () => {
+  const out = scrubText(
+    `key ${PLACEHOLDER_SECRET} Authorization: Bearer abc123 xdr ${"QUFB".repeat(60)}`
+  );
+  expect(out).not.toContain(PLACEHOLDER_SECRET);
+  expect(out).not.toContain("abc123");
+  expect(out).not.toContain("QUFB");
+  expect(out).toContain("[redacted-secret]");
+});
+
+test("literals the request carried are removed, escaped or not", () => {
+  expect(scrubText('memo "a\\b" and a\\b', ["a\\b"])).toBe('memo "[memo]" and [memo]');
+  expect(scrubText("memo 12", ["12"])).toBe("memo 12");
+});
diff --git a/apps/web/components/execution/ExecutionWizard.tsx b/apps/web/components/execution/ExecutionWizard.tsx
index bec26cc0..afbb1355 100644
--- a/apps/web/components/execution/ExecutionWizard.tsx
+++ b/apps/web/components/execution/ExecutionWizard.tsx
@@ -33,6 +33,7 @@ export default function ExecutionWizard({ network }: ExecutionWizardProps) {
   const mediatorRequired = useDemolishStore((s) => s.mediatorRequired);
   const phase = useDemolishStore((s) => s.phase);
   const lastError = useDemolishStore((s) => s.lastError);
+  const lastErrorReference = useDemolishStore((s) => s.lastErrorReference);
   const accountState = useDemolishStore((s) => s.accountState);
 
   const { run, progressStatus, signatureStatus, submitPreAuthTransaction } = useCloseExecution();
@@ -394,7 +395,14 @@ export default function ExecutionWizard({ network }: ExecutionWizardProps) {
                 className="flex items-start gap-2.5 rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-2.5 text-sm text-white/70 outline-none"
               >
                 <AlertCircle className="h-4 w-4 shrink-0 mt-0.5 text-danger-fg" />
-                <span>{lastError ?? "The close could not be completed."}</span>
+                <span>
+                  {lastError ?? "The close could not be completed."}
+                  {lastErrorReference && (
+                    <span className="mt-1 block text-xs text-fg-subtle">
+                      Reference: {lastErrorReference}
+                    </span>
+                  )}
+                </span>
               </div>
               <button
                 type="button"
diff --git a/apps/web/hooks/useCloseExecution.ts b/apps/web/hooks/useCloseExecution.ts
index d338b305..9e7fc164 100644
--- a/apps/web/hooks/useCloseExecution.ts
+++ b/apps/web/hooks/useCloseExecution.ts
@@ -28,7 +28,7 @@ import { submitViaApi } from "@/lib/stellar/submit-via-api";
 import { requestMediatorCosignature } from "@/lib/stellar/mediator";
 import { requestFeeBumpSponsorship } from "@/lib/stellar/fee-bump-sponsor";
 import { notifyStatsRefresh } from "@/lib/stats-events";
-import { toUserMessage, UserFacingError } from "@/lib/utils/user-error";
+import { requestIdOf, toUserMessage, UserFacingError } from "@/lib/utils/user-error";
 import type { TransactionSigner } from "@/lib/stellar/signer";
 import type { AccountSigner } from "@/types/account";
 
@@ -343,7 +343,7 @@ export function useCloseExecution() {
         // panel with no explanation of what went wrong.
         pendingRoundRef.current = null;
         setSignatureStatus(null);
-        setLastError(toUserMessage(err, "execute"));
+        setLastError(toUserMessage(err, "execute"), requestIdOf(err));
         setPhase("STEP_FAILED");
       } finally {
         setProgressStatus(null);
diff --git a/apps/web/lib/api/close-client.ts b/apps/web/lib/api/close-client.ts
index 6acf37c0..8c4b312d 100644
--- a/apps/web/lib/api/close-client.ts
+++ b/apps/web/lib/api/close-client.ts
@@ -5,6 +5,7 @@ import type {
   TransactionsResponse,
 } from "@lumenwipe/sdk";
 import type { Network } from "@/config/networks";
+import { apiRequestId } from "@/lib/api/error-body";
 import { ApiRequestError } from "@/lib/utils/user-error";
 
 /**
@@ -20,10 +21,12 @@ async function toError(res: Response): Promise<Error> {
     error?: { message?: string } | string;
   };
   if (typeof data.error === "object" && data.error?.message) {
-    return new ApiRequestError(res.status, data.error.message);
+    return new ApiRequestError(res.status, data.error.message, apiRequestId(res, data));
   }
-  if (typeof data.error === "string") return new ApiRequestError(res.status, data.error);
-  return new ApiRequestError(res.status, "");
+  if (typeof data.error === "string") {
+    return new ApiRequestError(res.status, data.error, apiRequestId(res, data));
+  }
+  return new ApiRequestError(res.status, "", apiRequestId(res, data));
 }
 
 /** Builds the deterministic close plan (decision points, estimate) via the proxy. */
diff --git a/apps/web/lib/api/error-body.ts b/apps/web/lib/api/error-body.ts
index 90c199b4..2da049db 100644
--- a/apps/web/lib/api/error-body.ts
+++ b/apps/web/lib/api/error-body.ts
@@ -20,6 +20,33 @@ export function looksPlain(message: string): boolean {
   );
 }
 
+const REQUEST_ID = /^[A-Za-z0-9-]{8,64}$/;
+
+export function isRequestId(value: unknown): value is string {
+  return typeof value === "string" && REQUEST_ID.test(value);
+}
+
+/** The id the API gave this request: the response header, else the envelope. Shown to the user,
+ *  so anything that is not id-shaped is dropped. */
+export function apiRequestId(
+  res: { headers: Pick<Headers, "get"> },
+  body: unknown
+): string | undefined {
+  const fromBody =
+    typeof body === "object" &&
+    body !== null &&
+    typeof (body as { error?: unknown }).error === "object"
+      ? ((body as { error: { requestId?: unknown } | null }).error?.requestId ?? undefined)
+      : undefined;
+  const candidate = res.headers.get("x-request-id") ?? fromBody;
+  return isRequestId(candidate) ? candidate : undefined;
+}
+
+/** The header the proxy relays so a failed call can be tied to the API's log line. */
+export function requestIdHeaders(requestId: unknown): Record<string, string> | undefined {
+  return isRequestId(requestId) ? { "x-request-id": requestId } : undefined;
+}
+
 export function apiErrorMessage(body: unknown, fallback: string): string {
   if (typeof body !== "object" || body === null) return fallback;
   const b = body as { error?: unknown; message?: unknown };
diff --git a/apps/web/lib/api/proxy.ts b/apps/web/lib/api/proxy.ts
index 667e5354..f60fb1ee 100644
--- a/apps/web/lib/api/proxy.ts
+++ b/apps/web/lib/api/proxy.ts
@@ -1,5 +1,6 @@
 import "server-only";
 import { NextResponse } from "next/server";
+import { requestIdHeaders } from "@/lib/api/error-body";
 import { LumenWipeApiError, LumenWipeTimeoutError } from "@lumenwipe/sdk";
 
 /**
@@ -23,7 +24,10 @@ export async function proxy<T>(
           : { error: String(e.body ?? "Upstream error") };
       // Guard against a 0/undefined status defaulting NextResponse to 200,
       // which would relay an error body as a success.
-      return NextResponse.json(body, { status: e.status || 502 });
+      return NextResponse.json(body, {
+        status: e.status || 502,
+        headers: requestIdHeaders(e.requestId),
+      });
     }
     if (e instanceof LumenWipeTimeoutError) {
       return NextResponse.json({ error: "The API request timed out." }, { status: 504 });
diff --git a/apps/web/lib/stellar/fee-bump-sponsor.ts b/apps/web/lib/stellar/fee-bump-sponsor.ts
index 1cc353aa..50affcba 100644
--- a/apps/web/lib/stellar/fee-bump-sponsor.ts
+++ b/apps/web/lib/stellar/fee-bump-sponsor.ts
@@ -1,4 +1,5 @@
 import type { Network } from "@/config/networks";
+import { apiRequestId } from "@/lib/api/error-body";
 import { ApiRequestError, UserFacingError } from "@/lib/utils/user-error";
 
 /**
@@ -30,7 +31,7 @@ export async function requestFeeBumpSponsorship(
         : typeof data.error === "string"
           ? data.error
           : "Failed to obtain a sponsored fee for this transaction.";
-    throw new ApiRequestError(res.status, message);
+    throw new ApiRequestError(res.status, message, apiRequestId(res, data));
   }
   if (!data.transaction) {
     throw new UserFacingError("The sponsor endpoint returned no transaction.");
diff --git a/apps/web/lib/stellar/mediator.ts b/apps/web/lib/stellar/mediator.ts
index a32200f3..f23b5e23 100644
--- a/apps/web/lib/stellar/mediator.ts
+++ b/apps/web/lib/stellar/mediator.ts
@@ -1,6 +1,6 @@
 import type { Network } from "@/config/networks";
 import { ApiRequestError } from "@/lib/utils/user-error";
-import { apiErrorMessage } from "@/lib/api/error-body";
+import { apiErrorMessage, apiRequestId } from "@/lib/api/error-body";
 
 /**
  * Asks the backend to co-sign the shared-mediator forward payment leg of the
@@ -22,7 +22,7 @@ export async function requestMediatorCosignature(
   });
   if (!res.ok) {
     const data = await res.json().catch(() => ({}) as { error?: string });
-    throw new ApiRequestError(res.status, apiErrorMessage(data, ""));
+    throw new ApiRequestError(res.status, apiErrorMessage(data, ""), apiRequestId(res, data));
   }
   const { transaction } = (await res.json()) as { transaction: string };
   return transaction;
diff --git a/apps/web/lib/stellar/submit-via-api.ts b/apps/web/lib/stellar/submit-via-api.ts
index fdb1abaa..0a117b05 100644
--- a/apps/web/lib/stellar/submit-via-api.ts
+++ b/apps/web/lib/stellar/submit-via-api.ts
@@ -1,4 +1,5 @@
 import type { Network } from "@/config/networks";
+import { apiRequestId } from "@/lib/api/error-body";
 import { ApiRequestError, UserFacingError } from "@/lib/utils/user-error";
 
 export interface SubmitResult {
@@ -32,7 +33,7 @@ export async function submitViaApi(signedXdr: string, network: Network): Promise
         : typeof data.error === "string"
           ? data.error
           : "Failed to submit the transaction.";
-    throw new ApiRequestError(res.status, message);
+    throw new ApiRequestError(res.status, message, apiRequestId(res, data));
   }
 
   // A 2xx with no hash means the response contract drifted; fail loudly rather
diff --git a/apps/web/lib/utils/user-error.ts b/apps/web/lib/utils/user-error.ts
index 3da16283..746d80cc 100644
--- a/apps/web/lib/utils/user-error.ts
+++ b/apps/web/lib/utils/user-error.ts
@@ -21,7 +21,8 @@ export class UserFacingError extends Error {
 export class ApiRequestError extends Error {
   constructor(
     readonly status: number,
-    message: string
+    message: string,
+    readonly requestId?: string
   ) {
     super(message);
     this.name = "ApiRequestError";
@@ -77,6 +78,12 @@ function fromStatus(status: number, apiMessage: string, context: ErrorContext):
   return FALLBACKS[context];
 }
 
+/** The id to quote when reporting a failed API call, when the error came from one. */
+export function requestIdOf(err: unknown): string | undefined {
+  if (err instanceof ApiRequestError || err instanceof LumenWipeApiError) return err.requestId;
+  return undefined;
+}
+
 /**
  * Turns anything thrown in the close flow into copy that is safe to render. Raw SDK, wallet and
  * network text never passes through: unknown errors collapse to a context-specific fallback and
diff --git a/apps/web/store/demolish.ts b/apps/web/store/demolish.ts
index 0ce5dc53..8ffcdaea 100644
--- a/apps/web/store/demolish.ts
+++ b/apps/web/store/demolish.ts
@@ -67,6 +67,7 @@ interface DemolishState {
 
   // Error
   lastError: string | null;
+  lastErrorReference: string | null;
 
   // Session
   sessionId: string | null;
@@ -108,7 +109,7 @@ interface DemolishState {
     coversTargets?: string[]
   ) => void;
   markStepFailed: (index: number, error: string) => void;
-  setLastError: (error: string | null) => void;
+  setLastError: (error: string | null, reference?: string) => void;
   initSession: () => void;
   restoreSession: (id: string) => void;
   reset: () => void;
@@ -192,6 +193,7 @@ const initialState = {
   claimableBalanceSelections: {},
   mediatorRequired: false,
   lastError: null,
+  lastErrorReference: null,
   sessionId: null,
 };
 
@@ -321,7 +323,7 @@ export const useDemolishStore = create<DemolishState>((set) => ({
       lastError: error,
     })),
 
-  setLastError: (lastError) => set({ lastError }),
+  setLastError: (lastError, reference) => set({ lastError, lastErrorReference: reference ?? null }),
 
   initSession: () => set({ sessionId: uuidv4() }),
 
diff --git a/apps/web/tests/unit/request-id.test.ts b/apps/web/tests/unit/request-id.test.ts
new file mode 100644
index 00000000..c193f3de
--- /dev/null
+++ b/apps/web/tests/unit/request-id.test.ts
@@ -0,0 +1,56 @@
+import { afterEach, expect, mock, spyOn, test } from "bun:test";
+import { LumenWipeApiError } from "@lumenwipe/sdk";
+import { fetchCloseTransactions } from "@/lib/api/close-client";
+import { apiRequestId, requestIdHeaders } from "@/lib/api/error-body";
+import { ApiRequestError, requestIdOf, toUserMessage } from "@/lib/utils/user-error";
+
+const ID = "0b1f2f6e-5d1c-4a52-9f0e-3a8a4b7c9d10";
+
+afterEach(() => {
+  mock.restore();
+});
+
+test("apiRequestId prefers the header, falls back to the envelope and drops anything not id-shaped", () => {
+  const res = (value: string | null) => ({
+    headers: new Headers(value ? { "x-request-id": value } : {}),
+  });
+  const body = { error: { code: "x", message: "m", requestId: ID } };
+  expect(apiRequestId(res("header-id-12345"), body)).toBe("header-id-12345");
+  expect(apiRequestId(res(null), body)).toBe(ID);
+  expect(apiRequestId(res("<script>alert(1)</script>"), {})).toBeUndefined();
+  expect(apiRequestId(res(null), { error: "flat" })).toBeUndefined();
+});
+
+test("the close client carries the id from the proxy response into the thrown error", async () => {
+  spyOn(globalThis, "fetch").mockResolvedValue(
+    new Response(
+      JSON.stringify({ error: { code: "service_unavailable", message: "Try again." } }),
+      {
+        status: 503,
+        headers: { "x-request-id": ID },
+      }
+    )
+  );
+  const error = await fetchCloseTransactions(
+    { source: "G", destination: "G" } as never,
+    "testnet"
+  ).catch((e: unknown) => e);
+  expect(error).toBeInstanceOf(ApiRequestError);
+  expect(requestIdOf(error)).toBe(ID);
+});
+
+test("the id never changes what toUserMessage says", () => {
+  for (const status of [400, 422, 429, 500, 503]) {
+    expect(
+      toUserMessage(new ApiRequestError(status, "Choose a destination first.", ID), "review")
+    ).toBe(toUserMessage(new ApiRequestError(status, "Choose a destination first."), "review"));
+  }
+  expect(requestIdOf(new LumenWipeApiError(500, {}, new Headers({ "X-Request-Id": ID })))).toBe(ID);
+  expect(requestIdOf(new Error("x"))).toBeUndefined();
+});
+
+test("the proxy relays only an id-shaped request id as a response header", () => {
+  expect(requestIdHeaders(ID)).toEqual({ "x-request-id": ID });
+  expect(requestIdHeaders("bad\r\nheader")).toBeUndefined();
+  expect(requestIdHeaders(undefined)).toBeUndefined();
+});
diff --git a/apps/web/tests/unit/use-close-execution.test.tsx b/apps/web/tests/unit/use-close-execution.test.tsx
index 6701008b..71613272 100644
--- a/apps/web/tests/unit/use-close-execution.test.tsx
+++ b/apps/web/tests/unit/use-close-execution.test.tsx
@@ -17,6 +17,7 @@ import { useNetworkStore } from "@/store/network";
 import * as closeClient from "@/lib/api/close-client";
 import * as submitViaApiModule from "@/lib/stellar/submit-via-api";
 import * as feeBumpSponsorModule from "@/lib/stellar/fee-bump-sponsor";
+import { ApiRequestError, toUserMessage } from "@/lib/utils/user-error";
 import type { TransactionSigner } from "@/lib/stellar/signer";
 
 /** The stand-ins return only what the hook reads, so they are typed loosely on purpose. */
@@ -825,3 +826,34 @@ test("useCloseExecution › a wallet rejection surfaces as plain language, never
   expect(lastError).toMatch(/declined the request in your wallet/);
   expect(lastError).not.toMatch(/User declined access/);
 });
+
+test("useCloseExecution › an API failure keeps its request id beside the unchanged user message", async () => {
+  const sourceKeypair = Keypair.random();
+  const source = sourceKeypair.publicKey();
+  useNetworkStore.setState({ network: "testnet" });
+  useDemolishStore.setState({
+    sourceAddress: source,
+    destinationAddress: Keypair.random().publicKey(),
+    memo: null,
+    mediatorRequired: false,
+    lastError: null,
+    lastErrorReference: null,
+    accountState: {
+      signers: [{ key: source, weight: 1, type: "ed25519_public_key" }],
+      thresholds: { low: 1, med: 1, high: 1 },
+    } as never,
+  } as never);
+  const id = "0b1f2f6e-5d1c-4a52-9f0e-3a8a4b7c9d10";
+  stubFetchCloseTransactions(async () => {
+    throw new ApiRequestError(503, "", id);
+  });
+
+  const { result } = renderHook(() => useCloseExecution());
+  await act(async () => {
+    await result.current.run(realSigner(sourceKeypair));
+  });
+
+  const state = useDemolishStore.getState();
+  expect(state.lastError).toBe(toUserMessage(new ApiRequestError(503, ""), "execute"));
+  expect(state.lastErrorReference).toBe(id);
+});
diff --git a/docs/api-reference/introduction.mdx b/docs/api-reference/introduction.mdx
index b4b0fa25..b36b6858 100644
--- a/docs/api-reference/introduction.mdx
+++ b/docs/api-reference/introduction.mdx
@@ -173,6 +173,10 @@ Each endpoint page lists the codes that endpoint can return. Every error respons
 
 {/* error-codes:end */}
 
+## Request ids
+
+Every response, success or error, carries an `X-Request-Id` header. An error body repeats it as `error.requestId`. The API generates the id for each request and ignores any value a caller sends. Quote it when you report a problem, so it can be matched to the log line for that request. What the logs hold is described in [Logging and privacy](/reference/logging-and-privacy).
+
 ## Rate limits
 
 Requests are limited per API key, and per client IP when a request carries no key. One budget covers every endpoint. The default is 120 requests per 60 seconds. A key issued through the self-serve flow can carry its own limit and window, which replaces the default for that key only. Rate limiting applies before authentication and before the request body is read, so requests without a valid key, unknown routes and malformed bodies count against the budget too. The service index, the health checks and the documentation pages are not limited.
diff --git a/docs/api-reference/openapi.json b/docs/api-reference/openapi.json
index c048a850..ac6741e2 100644
--- a/docs/api-reference/openapi.json
+++ b/docs/api-reference/openapi.json
@@ -6524,6 +6524,10 @@
           "details": {
             "type": "object",
             "description": "Extra structured context, present only when there is more to say."
+          },
+          "requestId": {
+            "type": "string",
+            "description": "The id of this request, also returned in the x-request-id header. Quote it when reporting a problem."
           }
         },
         "required": [
diff --git a/docs/docs.json b/docs/docs.json
index 0e765014..f37e3446 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -69,7 +69,12 @@
       },
       {
         "group": "Reference",
-        "pages": ["reference/glossary", "reference/supported", "changelog"]
+        "pages": [
+          "reference/glossary",
+          "reference/supported",
+          "reference/logging-and-privacy",
+          "changelog"
+        ]
       },
       {
         "group": "SDK",
diff --git a/docs/reference/logging-and-privacy.mdx b/docs/reference/logging-and-privacy.mdx
new file mode 100644
index 00000000..d1aea904
--- /dev/null
+++ b/docs/reference/logging-and-privacy.mdx
@@ -0,0 +1,48 @@
+---
+title: "Logging and privacy"
+description: "What the LumenWipe API writes to its logs, what it never writes, how long logs are kept and who can read them."
+icon: "shield-halved"
+---
+
+LumenWipe is non-custodial and keeps no record of who closed which account. The API's logs follow from that: they exist to find and fix failures, and they are written so they cannot be used to reconstruct a close.
+
+## Request ids
+
+Every API response carries an `X-Request-Id` header, and every error body repeats it as `error.requestId`. The id is generated by the API for each request; a value sent by the caller is ignored. The web app shows it as a reference beside a failed close, and `@lumenwipe/sdk` exposes it as `LumenWipeApiError.requestId`. Quote it when you report a problem: it is the key to the one log line written for that request.
+
+## What is logged
+
+The API writes one JSON object per line to standard output. Cloud Run forwards each line to Cloud Logging, which reads the `severity` field to classify the entry (`DEBUG`, `INFO`, `WARNING`, `ERROR` or `CRITICAL`).
+
+Each request produces one line when its response is sent:
+
+| Field       | Content                                                                                   |
+| ----------- | ----------------------------------------------------------------------------------------- |
+| `requestId` | The id returned to the caller.                                                            |
+| `route`     | The route pattern, for example `/v1/:network/close/plan`, never the path that was called. |
+| `status`    | The HTTP status code.                                                                     |
+| `latencyMs` | Time to answer, in milliseconds.                                                          |
+| `keyLabel`  | The label of the API key, when the request carried a valid one.                           |
+| `network`   | `testnet` or `mainnet`, when the route names one.                                         |
+
+Failures inside a request add lines with a message, the error's stack and the same `requestId`. The service also logs its own start-up and degraded-dependency messages.
+
+## What is never logged
+
+- Request or response bodies.
+- Memos and deposit tags.
+- The destination of an exchange close. Any address that belongs to a listed exchange is written as the fixed token `[exchange]`, with no prefix, suffix or hash.
+- Secret keys, bearer tokens and signed transaction envelopes.
+- Client IP addresses. The platform's own request log is the only place an address is recorded, under the platform's own policy.
+
+## How addresses appear
+
+Any other account address that reaches a log line is cut to its first four and last four characters, followed by a short keyed hash, for example `GABC...WXYZ~1a2b3c4d`. The hash lets two lines about the same address be matched without storing it, and it cannot be reversed to the address. It is derived with a key held by the operator, so it means nothing outside the deployment that wrote it.
+
+## How the policy is enforced
+
+The rules are applied where lines are written, not left to each call site. Before a line leaves the process, the logger replaces secret-shaped strings, bearer tokens, long encoded blobs and full addresses as described above, and removes any memo the request itself carried, including one inside a signed envelope. Route patterns are logged instead of paths so that addresses in a URL never reach the line. Automated tests run a close that fails at every step and assert that no full address, memo, secret-shaped string or body appears in any line.
+
+## Retention and access
+
+Logs go to standard output, Cloud Run forwards them to Cloud Logging, and retention is that log bucket's setting. The default bucket keeps entries for 30 days unless the operator changes it. Reading them requires logging permission on the Google Cloud project that runs the API; nobody else, including API integrators, can read them.
diff --git a/docs/sdk/errors.mdx b/docs/sdk/errors.mdx
index 1fc088ab..e3c93feb 100644
--- a/docs/sdk/errors.mdx
+++ b/docs/sdk/errors.mdx
@@ -36,7 +36,7 @@ try {
 }
 ```
 
-`code` is one of the API's documented error codes, or `"upstream_error"` when a proxy or CDN in front of the API returned a non-JSON failure. `retryAfterMs` is `undefined` when the response has no `Retry-After`. `requestId` is `undefined` until the API sends `X-Request-Id`.
+`code` is one of the API's documented error codes, or `"upstream_error"` when a proxy or CDN in front of the API returned a non-JSON failure. `retryAfterMs` is `undefined` when the response has no `Retry-After`. `requestId` is the value of the `X-Request-Id` response header, the same id the error body carries as `error.requestId`; it is `undefined` only when the failure came from something in front of the API. Quote it when reporting a problem.
 
 ## Retrying safely
 
diff --git a/packages/sdk/CHANGELOG.md b/packages/sdk/CHANGELOG.md
index 67cf57f7..33039b6a 100644
--- a/packages/sdk/CHANGELOG.md
+++ b/packages/sdk/CHANGELOG.md
@@ -7,6 +7,14 @@ release is cut.
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-10-10
+
+### Added
+
+- `StructuredApiError.error` gains an optional `requestId`: every API error body now carries the
+  id of the request, the same value as the `x-request-id` response header that
+  `LumenWipeApiError.requestId` already reads. Quote it when reporting a problem. Purely additive.
+
 ## [0.5.0] - 2026-10-10
 
 ### Changed
diff --git a/packages/sdk/etc/sdk.api.md b/packages/sdk/etc/sdk.api.md
index 1bf1f99e..442be60f 100644
--- a/packages/sdk/etc/sdk.api.md
+++ b/packages/sdk/etc/sdk.api.md
@@ -949,6 +949,7 @@ export interface StructuredApiError {
         code: string;
         message: string;
         details?: unknown;
+        requestId?: string;
     };
 }
 
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index 43134513..0107aeb1 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lumenwipe/sdk",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Typed fetch client for the LumenWipe API - non-custodial Stellar account closing.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/sdk/src/version.ts b/packages/sdk/src/version.ts
index 18e17717..c29229bf 100644
--- a/packages/sdk/src/version.ts
+++ b/packages/sdk/src/version.ts
@@ -1 +1 @@
-export const SDK_VERSION = "0.5.0";
+export const SDK_VERSION = "0.5.1";
diff --git a/packages/types/src/errors.ts b/packages/types/src/errors.ts
index 4dd57f14..e84a7fa6 100644
--- a/packages/types/src/errors.ts
+++ b/packages/types/src/errors.ts
@@ -113,7 +113,7 @@ export type ErrorCode =
 
 /** The single error envelope every API error response carries. */
 export interface StructuredApiError {
-  error: { code: string; message: string; details?: unknown };
+  error: { code: string; message: string; details?: unknown; requestId?: string };
 }
 
 export type ApiErrorBody = StructuredApiError;