root
8fc88ffc14
Build & Push / Pipeline Tests (push) Failing after 59s
Build & Push / Build & Push Docker Image (push) Has been skipped
Test / Type Check (all packages) (push) Failing after 51s
Test / API Unit Tests (push) Has been skipped
Test / Homepage Unit Tests (push) Has been skipped
Test / Carplace Unit Tests (push) Has been skipped
Test / Admin Unit Tests (push) Has been skipped
Test / Dashboard Unit Tests (push) Has been skipped
Test / API Integration Tests (push) Has been skipped
2.3 KiB
2.3 KiB
Privacy data map (Phase 2 baseline)
Status: Baseline inventory for production-readiness — not a legal opinion or DPIA.
Owner: Engineering + ops (assign legal owner before GA)
Date: 2026-08-12
Data classes
| Class | Examples | Storage | Access | Retention target (TBD / approve) |
|---|---|---|---|---|
| Account identity | Employee/admin/renter email, name, phone | PostgreSQL | Tenant roles / admin | Account life + 30 days |
| Auth secrets | Password hashes, TOTP secrets, hashed reset tokens | PostgreSQL | Auth services only | Until rotated/cleared |
| Customer PII | Customer name, DOB, nationality, address | PostgreSQL | Tenant employees | Contract life + local legal minimum |
| License evidence | License images, numbers, expiry | Private storage + DB refs | Authenticated customer routes | Contract life + dispute window |
| Rental evidence | Reservation photos, contracts/PDFs, damage inspections | Private/public storage + DB | Tenant + limited public tokens | Contract life + dispute window |
| Billing | Invoices, payment intents, manual payment evidence | PostgreSQL + private storage | Finance roles + fresh admin 2FA where required | 7–10 years (finance — confirm) |
| Notifications | Notification events, deliveries, preferences | PostgreSQL | Actor inbox APIs | 90–180 days operational |
| Audit | Admin AuditLog rows |
PostgreSQL | Admin roles | 1–2 years minimum |
Controls in code today
- Private storage split + blocked anonymous customer/reservation storage paths
- HttpOnly cookies; admin 2FA; hashed API keys / invite tokens (Phase 0)
- Admin audit log for privileged platform actions
- Ops metrics do not include PII payloads
Gaps to close before claiming privacy compliance
- Field-level encryption for highest-risk PII (license numbers, government IDs)
- Automated retention/deletion jobs with legal hold exceptions
- DSAR export/delete runbooks with evidence
- Privileged-read logging for license images and payment evidence downloads
- Processor inventory + DPA list
Privileged-read audit expectation
Every successful read of license images, contract PDFs, damage photos, or payment evidence by support/admin impersonation must write an AuditLog (or equivalent immutable record) with actor, subject, resource id, and request id.