Context
Stackra’s security target includes GDPR practices, and products that install it hold personal data about their tenants’ users. Per-model PII field encryption and archive, soft or hard delete policies are planned opt-ins in the data model. Apple requires a privacy manifest and App Tracking Transparency handling for iOS apps.Decision
- Data export and erasure are framework capabilities: a subject’s data can be exported and erased through one audited operation per service that owns personal data. Erasure follows each model’s delete policy (archive, soft, hard).
- Personal data is declared per model (the PII opt-in), so export and erasure can enumerate it.
- iOS apps ship a privacy manifest listing collected data and required-reason API use. Dependencies’ manifests are checked at build.
- ATT: tracking is off by default; a product that enables it shows the ATT prompt and says why in the manifest.
- Templates for a privacy policy and a data-processing agreement live in the docs for products to adapt. They are templates, not legal advice; legal review is each product’s.
- Logs, error reports and analytics carry no personal data (0020 rule 3, 0073).
Consequences
- Every model holding PII has more required metadata.
- Erasure from backups follows the point-in-time retention window; the statement made to users is
TODO.