My preferred method is to tokenize sensitive data before storing in the immutable logs/database.