GDPR — Technical Controls

⚠️ Disclaimer: this page documents technical controls relevant to GDPR principles. It is not a legal certification. For compliance certification, consult your Data Protection Officer (DPO) or legal counsel.

Architecture (ZDR — Zero Data Retention)

Factum Parse implements a Zero Data Retention (ZDR) architecture for PII processing:

1. Direct text (POST /v1/parse with text field): the text payload is processed entirely in RAM, never written to disk or database. No ParseJob record is created.
2. PII pseudonymization (Rizzo sidecar): all 22 categories of personal data are masked before the payload reaches any LLM provider. The mapping is ephemeral and request-scoped.
3. Upload artifacts (POST /v1/uploads): XML/PDF files may be persisted temporarily in object storage with configurable TTL (default: 1 day).

Data flow vs. GDPR principles

GDPR principle	Implementation
Data minimization (Art. 5(1)(c))	Only document data needed for parsing is processed. PII is masked before LLM transmission.
Storage limitation (Art. 5(1)(e))	Direct text: zero retention. Uploads: TTL-governed (default 1 day). Cache: 30 days max.
Integrity & confidentiality (Art. 32)	Fail-closed architecture. Sidecar failure → 503, never clear-text fallback. TLS in transit.
Accountability (Art. 5(2))	Prometheus metrics, audit logging, OpenAPI contract.

Technical controls

• Pseudonymization: 22 PII categories detected and masked by the Rizzo sidecar before external LLM processing.
• Fail-closed privacy boundary: if RIZZO_PII_REQUIRED=true (production default) and the sidecar is unreachable, the API returns 503 Service Unavailable.
• No persistent PII mapping: the pseudonymization mapping exists only in RAM during request processing. The LLM receives masked text; restoration happens locally after extraction.
• Configurable TTLs: upload artifacts default to 1-day lifecycle; document cache defaults to 30-day TTL.
• Prometheus observability: rizzo_pii_* metrics for runtime verification of the privacy boundary.

Retained data (uploads)

When a document is uploaded via POST /v1/uploads:

Artifact	Retention	Rationale
Uploaded file (object storage)	1 day (default)	Reprocessing / debugging
Job metadata (database)	30 days (default)	Status polling, audit
Deterministic parse result (cache)	30 days (default)	Deduplication speed-up
LLM parse result	Not persisted for text; TTL-governed for jobs	ZDR principle

What we do NOT do

• ❌ Store PII mapping on disk or in database
• ❌ Send clear text to external LLM providers
• ❌ Use customer data for model training
• ❌ Process data outside EU infrastructure (Hetzner eu-central)

Relevant configuration

Variable	Default	Effect
RIZZO_PII_REQUIRED	true	Enforce fail-closed PII boundary
FACTUM_DOCUMENT_CACHE_TTL	30	Document cache TTL in days
FACTUM_STORAGE_LIFECYCLE	1	Object storage lifecycle in days