root
8fc88ffc14
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 51s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
38 lines
2.3 KiB
Markdown
38 lines
2.3 KiB
Markdown
# Privacy data map (Phase 2 baseline)
|
||
|
||
**Status:** Baseline inventory for production-readiness — not a legal opinion or DPIA.
|
||
**Owner:** Engineering + ops (assign legal owner before GA)
|
||
**Date:** 2026-08-12
|
||
|
||
## Data classes
|
||
|
||
| Class | Examples | Storage | Access | Retention target (TBD / approve) |
|
||
|-------|----------|---------|--------|-----------------------------------|
|
||
| Account identity | Employee/admin/renter email, name, phone | PostgreSQL | Tenant roles / admin | Account life + 30 days |
|
||
| Auth secrets | Password hashes, TOTP secrets, hashed reset tokens | PostgreSQL | Auth services only | Until rotated/cleared |
|
||
| Customer PII | Customer name, DOB, nationality, address | PostgreSQL | Tenant employees | Contract life + local legal minimum |
|
||
| License evidence | License images, numbers, expiry | Private storage + DB refs | Authenticated customer routes | Contract life + dispute window |
|
||
| Rental evidence | Reservation photos, contracts/PDFs, damage inspections | Private/public storage + DB | Tenant + limited public tokens | Contract life + dispute window |
|
||
| Billing | Invoices, payment intents, manual payment evidence | PostgreSQL + private storage | Finance roles + fresh admin 2FA where required | 7–10 years (finance — confirm) |
|
||
| Notifications | Notification events, deliveries, preferences | PostgreSQL | Actor inbox APIs | 90–180 days operational |
|
||
| Audit | Admin `AuditLog` rows | PostgreSQL | Admin roles | 1–2 years minimum |
|
||
|
||
## Controls in code today
|
||
|
||
- Private storage split + blocked anonymous customer/reservation storage paths
|
||
- HttpOnly cookies; admin 2FA; hashed API keys / invite tokens (Phase 0)
|
||
- Admin audit log for privileged platform actions
|
||
- Ops metrics do **not** include PII payloads
|
||
|
||
## Gaps to close before claiming privacy compliance
|
||
|
||
- [ ] Field-level encryption for highest-risk PII (license numbers, government IDs)
|
||
- [ ] Automated retention/deletion jobs with legal hold exceptions
|
||
- [ ] DSAR export/delete runbooks with evidence
|
||
- [ ] Privileged-read logging for license images and payment evidence downloads
|
||
- [ ] Processor inventory + DPA list
|
||
|
||
## Privileged-read audit expectation
|
||
|
||
Every successful read of license images, contract PDFs, damage photos, or payment evidence by support/admin impersonation must write an `AuditLog` (or equivalent immutable record) with actor, subject, resource id, and request id.
|