fix production issues

2026-08-12 16:48:41 -04:00
parent 53de25120a
commit 8fc88ffc14
117 changed files with 4717 additions and 1443 deletions
@@ -0,0 +1,37 @@
+# Privacy data map (Phase 2 baseline)
+
+**Status:** Baseline inventory for production-readiness — not a legal opinion or DPIA.  
+**Owner:** Engineering + ops (assign legal owner before GA)  
+**Date:** 2026-08-12
+
+## Data classes
+
+| Class | Examples | Storage | Access | Retention target (TBD / approve) |
+|-------|----------|---------|--------|-----------------------------------|
+| Account identity | Employee/admin/renter email, name, phone | PostgreSQL | Tenant roles / admin | Account life + 30 days |
+| Auth secrets | Password hashes, TOTP secrets, hashed reset tokens | PostgreSQL | Auth services only | Until rotated/cleared |
+| Customer PII | Customer name, DOB, nationality, address | PostgreSQL | Tenant employees | Contract life + local legal minimum |
+| License evidence | License images, numbers, expiry | Private storage + DB refs | Authenticated customer routes | Contract life + dispute window |
+| Rental evidence | Reservation photos, contracts/PDFs, damage inspections | Private/public storage + DB | Tenant + limited public tokens | Contract life + dispute window |
+| Billing | Invoices, payment intents, manual payment evidence | PostgreSQL + private storage | Finance roles + fresh admin 2FA where required | 7–10 years (finance — confirm) |
+| Notifications | Notification events, deliveries, preferences | PostgreSQL | Actor inbox APIs | 90–180 days operational |
+| Audit | Admin `AuditLog` rows | PostgreSQL | Admin roles | 1–2 years minimum |
+
+## Controls in code today
+
+- Private storage split + blocked anonymous customer/reservation storage paths
+- HttpOnly cookies; admin 2FA; hashed API keys / invite tokens (Phase 0)
+- Admin audit log for privileged platform actions
+- Ops metrics do **not** include PII payloads
+
+## Gaps to close before claiming privacy compliance
+
+- [ ] Field-level encryption for highest-risk PII (license numbers, government IDs)
+- [ ] Automated retention/deletion jobs with legal hold exceptions
+- [ ] DSAR export/delete runbooks with evidence
+- [ ] Privileged-read logging for license images and payment evidence downloads
+- [ ] Processor inventory + DPA list
+
+## Privileged-read audit expectation
+
+Every successful read of license images, contract PDFs, damage photos, or payment evidence by support/admin impersonation must write an `AuditLog` (or equivalent immutable record) with actor, subject, resource id, and request id.