GDPR — Technical Controls

This page documents technical controls that can support a GDPR-compliant processing architecture. It is not a legal opinion, certification, or statement that Factum Parse is independently certified compliant.

Article 5 — minimisation and storage limitation

The strongest current guarantees are scoped to the actual data path:

• Direct POST /v1/parse text is request-scoped and does not create a persistent job.
• The Rizzo PII mapping is held in RAM for the request and used for local restoration.
• With RIZZO_PII_REQUIRED=true, clear-text input is not deliberately sent to the external LLM when the sidecar is unavailable; the request fails closed with 503.
• Uploaded XML/PDF files are not zero-retention: the current backend supports object storage with a default one-day lifecycle, plus job/cache persistence with explicit TTLs.
• Deterministic FatturaPA XML results can contain the original structured invoice data in the job/cache path. Do not describe those records as PII-free.

Article 25 — data protection by design

The relevant design controls are:

1. PII pseudonymization before the external LLM path.
2. Local, request-scoped restoration using the Rizzo mapping.
3. Fail-closed behavior when the required privacy sidecar is unavailable.
4. Bounded upload/body sizes to reduce memory and denial-of-service exposure.
5. Hash-based deduplication and explicit TTLs for persisted upload artifacts.

These are implementation controls, not a certification of Article 25 compliance.

Article 32 — security of processing

Control	Current implementation
API authentication	X-API-Key; constant-time comparison
Privacy gate	Rizzo sidecar before external LLM path
Fail-closed privacy	Sidecar unavailable → 503 when required
Upload bounds	10 MiB transport/upload ceiling
Rate limiting	Redis-backed middleware when enabled
Runtime observability	Prometheus metrics
Storage lifecycle	Explicit object/cache TTL configuration

EU / sovereign processing claim

The intended architecture is EU-hosted processing with a clear-text PII boundary before the external LLM path. The phrase “sovereign EU/IT infrastructure” should therefore be read as an architectural positioning statement, not as a legal status or blanket guarantee about every upstream provider.

The exact deployment region, storage provider, LLM provider and contractual data-processing terms must be verified for the production environment before making a stronger residency or GDPR claim.

Operational evidence

For an audit, the useful evidence is not marketing copy. Preserve:

• backend source and configuration;
• deployment configuration for storage/region;
• Rizzo runtime configuration;
• access/control logs where appropriate;
• reproducible tests for the privacy gate;
• retention/TTL configuration and deletion evidence.