GDPR — Controlli Tecnici

This page documents technical controls that can support a GDPR-compliant processing architecture. It is not a legal opinion, certification, or statement that Factum Parse is independently certified compliant.

Matrice di conformità GDPR

Principio GDPR	Controllo tecnico	Implementazione
Art. 5(1)(c) — Minimizzazione	Elaborazione RAM-only per testo diretto	POST /v1/parse con text non crea job persistente. Nessun write su DB. Il payload esiste solo in RAM per la durata della richiesta.
Art. 5(1)(e) — Limitazione conservazione	TTL esplicito su artefatti upload	Oggetti S3: default 1 giorno. Cache job: TTL configurabile. Nessun retention indefinito.
Art. 25 — Data Protection by Design	Pseudonimizzazione PII prima dell’LLM	Sidecar Rizzo analizza e sostituisce 22 categorie PII in-RAM. L’LLM vede solo testo pseudonimizzato. Mapping restore locale dopo risposta LLM.
Art. 28 — Responsabile trattamento	Confine EU per elaborazione	Infrastruttura Hetzner eu-central (Nürnberg). Sidecar Rizzo in stessa VPC. Architettura progettata per sanitizzazione request-scoped in memoria volatile prima della chiamata a modelli esterni.
Art. 32 — Sicurezza del trattamento	Fail-closed su privacy	Sidecar Rizzo non raggiungibile → HTTP 503. Mai testo scoperto all’LLM. Non esiste degradazione a testo plaintext.
Art. 32 — Autenticazione	X-API-Key con confronto constant-time	secrets.compare_digest(). Chiave assente/errata → 401. Fail-closed: chiave non configurata → tutti gli endpoint bloccati.
Art. 32 — Rate limiting	Middleware Redis-backed	60/100/1000 req/min per tier. Protegge da abuso e DoS. Fail-open se Redis non configurato.

Flusso ZDR — zero data retention

Article 5 — minimisation and storage limitation

The strongest current guarantees are scoped to the actual data path:

• Direct POST /v1/parse text is request-scoped and does not create a persistent job.
• The Rizzo PII mapping is held in RAM for the request and used for local restoration.
• With RIZZO_PII_REQUIRED=true, clear-text input is not deliberately sent to the external LLM when the sidecar is unavailable; the request fails closed with 503.
• Uploaded XML/PDF files are not zero-retention: the current backend supports object storage with a default one-day lifecycle, plus job/cache persistence with explicit TTLs.
• Deterministic FatturaPA XML results can contain the original structured invoice data in the job/cache path. Do not describe those records as PII-free.

Article 25 — data protection by design

The relevant design controls are:

1. PII pseudonymization before the external LLM path.
2. Local, request-scoped restoration using the Rizzo mapping.
3. Fail-closed behavior when the required privacy sidecar is unavailable.
4. Bounded upload/body sizes to reduce memory and denial-of-service exposure.
5. Hash-based deduplication and explicit TTLs for persisted upload artifacts.

These are implementation controls, not a certification of Article 25 compliance.

Article 32 — security of processing

Control	Current implementation
API authentication	X-API-Key; constant-time comparison
Privacy gate	Rizzo sidecar before external LLM path
Fail-closed privacy	Sidecar unavailable → 503 when required
Upload bounds	10 MiB transport/upload ceiling
Rate limiting	Redis-backed middleware when enabled
Runtime observability	Prometheus metrics
Storage lifecycle	Explicit object/cache TTL configuration

EU / sovereign processing claim

The intended architecture is EU-hosted processing with a clear-text PII boundary before the external LLM path. The phrase “sovereign EU/IT infrastructure” should therefore be read as an architectural positioning statement, not as a legal status or blanket guarantee about every upstream provider.

The exact deployment region, storage provider, LLM provider and contractual data-processing terms must be verified for the production environment before making a stronger residency or GDPR claim.

Operational evidence

For an audit, the useful evidence is not marketing copy. Preserve:

• backend source and configuration;
• deployment configuration for storage/region;
• Rizzo runtime configuration;
• access/control logs where appropriate;
• reproducible tests for the privacy gate;
• retention/TTL configuration and deletion evidence.