Compliance readiness

The invitee's email is cleared when an invitation is accepted, revoked or expires, so it can no longer re-identify a deleted user. Settled invitations are deleted after 30 days.

Pending uploads older than 24 hours are deleted with their objects. A purged workspace's storage prefix is swept again after upload links expire.

POST /v1/identities/me/exports needs a recent sign-in and allows one export a day. The Privacy module gathers records from every module through <module>.personal_data.v1 and writes one JSON bundle, served through a 5-minute link and deleted after 24 hours. Requests, downloads and failures are audited.

The server binary includes erase-identity, suspend-identity, unsuspend-identity, erase-invitee, export-identity and reapply-erasures. Each needs an operator name and a reason, and both are audited. The runbook is backend/PRIVACY.md.

In production the server refuses to start unless PostgreSQL uses verify-full or verify-ca, NATS uses TLS with a token, SMTP requires TLS, and internal URLs use HTTPS. HSTS is sent on every response.

audit.prune_entries deletes entries older than AUDIT_RETENTION_DAYS (default 400). Retention for every table is in the data inventory.

Sign-up requires the current TERMS_VERSION and records the acceptance. The record survives identity deletion as proof.

contracts/privacy/inventory.yaml lists every personal-data column, event payload, stored object, mail and log, with its purpose, lawful basis, retention, erasure path and subprocessors. New modules must add to it.

Every erasure writes an entry to S3, outside the database, holding only IDs or a keyed hash of the email. reapply-erasures --since repeats them after a restore. In production the bucket must use Object Lock.

TOTP MFA with recovery codes, WebAuthn passkeys, OAuth sign-in, email change confirmed at the new address, password change that revokes other sessions, a 10-minute re-authentication window for sensitive actions, and security notice emails. Go/Nest and browser journeys cover the local flows; configure and verify real OAuth providers and callback origins before launch.

Audit records sign-out, session revocations, profile changes, throttle trips, MFA, email and password changes, re-authentication, operator actions and exports, each with the client IP. Behind the edge the IP arrives in a signed header.

Every entry is hash-chained over the previous one. An hourly job verifies the chain and raises a critical alert on a break. Entries are exported every 5 minutes to an S3 feed, whose bucket must use Object Lock in production, and the audit database role can only insert and read.

Workspace owners and admins read their log at GET /v1/accounts/{id}/audit-log. Every user sees their own security activity at GET /v1/identities/me/security-activity. The S3 export feed can be connected to a selected SIEM.

Alert rules cover sign-in and MFA failures, throttling, rate limiting, authorization denials, audit chain breaks and export lag. On-call routing is organisational.

Each module connects as its own bento_rt_<schema> role, limited to its schema. Only the migrator changes schemas. Local development runs the same way.

Current workflows include HTTP breaking-change checks, Go vulnerability scanning, Nest dependency auditing, secret scanning, dependency updates, and Go/Nest CI. Confirm required checks and branch rules in the chosen repository before release.

A 72-hour idle timeout, session secret rotation, and a per-IP limit of 30 requests a minute on POST /v1/auth/*.

Encrypted backup primitives and selected Go/Nest restore drills already exist, including object recovery and erasure-ledger replay. Provision provider backups/PITR, schedule those checks against the selected deployment, approve RTO/RPO, and connect external uptime checks. Disposable drills do not establish production disaster recovery.

The same sealed-token approach Identity already uses for its mail events.

Set server-side encryption explicitly and check the bucket policy at startup.

Part of the trust work.

Go's logger is safe by construction; Nest's is safe by convention.

Cancel the provider subscription on close, include billing contacts in export and erasure, and list the provider as a subprocessor.

Zero-retention provider terms, no prompt logging, and a DPIA before launch.

Assess which AI Act roles and transparency requirements apply to the product and each AI feature. Bento stores task/run records and supports provider adapters; product UI disclosures, provider terms, user notices and any required AI-literacy or risk process need a product-specific review.

Assess whether the service falls within applicable cloud-switching and portability requirements. Bento currently provides a personal-data export; a product that needs workspace-level portability should define and verify an export format for members, files, audit history, Chat and AI records.

Review whether the product and target market are in scope, then assess the web and mobile interfaces against applicable accessibility requirements. Current UX/accessibility qualification remains product work; automated axe checks, theme contrast review, and keyboard and screen-reader journeys are useful next checks.

The GDPR controls already cover access, deletion and correction. What remains is mostly the privacy notice, plus honouring the Global Privacy Control signal if analytics or advertising tracking is ever added. There is none today.

Keep card data out of Bento entirely by using the provider's hosted checkout or payment elements, which keeps the business at the lightest self-assessment, SAQ A. Record this constraint in backend/BILLING.md.

Many EU buyers ask for ISO 27001 instead of SOC 2. The controls overlap heavily, so the evidence map in backend/SECURITY-CONTROLS.md carries over; the new work is a formal information security management system and a certification audit.

Keep a completed CSA CAIQ, or similar, ready to send. It takes hours once and saves weeks per deal.

These EU rules bind financial and critical-sector customers, who pass clauses on to suppliers: incident notification times, exit plans, audit rights and subcontractor lists. The incident response policy and the workspace export above cover most of it.

Publish how to report a vulnerability, and a /.well-known/security.txt on the product domain.

Generate an SBOM in CI for both backends and the frontends, next to govulncheck and npm audit. The EU Cyber Resilience Act mostly does not apply to pure SaaS, but buyers increasingly ask for one.

Record where each subprocessor stores data, relying on the EU–US Data Privacy Framework with standard contractual clauses as a fallback. Add a region setting once infra/deployments exists.