# Privacy data map (Phase 2 baseline)

**Status:** Baseline inventory for production-readiness — not a legal opinion or DPIA.  
**Owner:** Engineering + ops (assign legal owner before GA)  
**Date:** 2026-08-12

## Data classes

| Class | Examples | Storage | Access | Retention target (TBD / approve) |
|-------|----------|---------|--------|-----------------------------------|
| Account identity | Employee/admin/renter email, name, phone | PostgreSQL | Tenant roles / admin | Account life + 30 days |
| Auth secrets | Password hashes, TOTP secrets, hashed reset tokens | PostgreSQL | Auth services only | Until rotated/cleared |
| Customer PII | Customer name, DOB, nationality, address | PostgreSQL | Tenant employees | Contract life + local legal minimum |
| License evidence | License images, numbers, expiry | Private storage + DB refs | Authenticated customer routes | Contract life + dispute window |
| Rental evidence | Reservation photos, contracts/PDFs, damage inspections | Private/public storage + DB | Tenant + limited public tokens | Contract life + dispute window |
| Billing | Invoices, payment intents, manual payment evidence | PostgreSQL + private storage | Finance roles + fresh admin 2FA where required | 7–10 years (finance — confirm) |
| Notifications | Notification events, deliveries, preferences | PostgreSQL | Actor inbox APIs | 90–180 days operational |
| Audit | Admin `AuditLog` rows | PostgreSQL | Admin roles | 1–2 years minimum |

## Controls in code today

- Private storage split + blocked anonymous customer/reservation storage paths
- HttpOnly cookies; admin 2FA; hashed API keys / invite tokens (Phase 0)
- Admin audit log for privileged platform actions
- Ops metrics do **not** include PII payloads

## Gaps to close before claiming privacy compliance

- [ ] Field-level encryption for highest-risk PII (license numbers, government IDs)
- [ ] Automated retention/deletion jobs with legal hold exceptions
- [ ] DSAR export/delete runbooks with evidence
- [ ] Privileged-read logging for license images and payment evidence downloads
- [ ] Processor inventory + DPA list

## Privileged-read audit expectation

Every successful read of license images, contract PDFs, damage photos, or payment evidence by support/admin impersonation must write an `AuditLog` (or equivalent immutable record) with actor, subject, resource id, and request id.