Admin · Governance · Privacy
Privacy, by posture.
Data residency derived from the sovereignty posture, subject-request countdowns that read honestly, and regulatory changes linked back into the compliance register. One erasure request is overdue and says so in text and pill.
Residency regions3sovereignty-derived
Open requests3subject rights
Due soon1within 24h
Overdue1past deadline
Residency rules
derived from sovereignty posture| Region | Mode | Data plane | Key custody | Notes |
|---|---|---|---|---|
| US | Sovereign | self-hosted | provider HSM | Sovereign-ready; exit plan tested. |
| EU | Hosted | regional plane | platform KMS (regional) | GDPR residency; cross-border transfers gated by the DPA. |
| APAC | Hosted | regional plane | platform KMS (regional) | Local data-plane; no EU/US egress without consent. |
Subject requests
countdowns · live| Request | Type | Account | Opened | Deadline | Countdown |
|---|---|---|---|---|---|
| DSR-298 | erasure | Acme Retailacct-acme | 2026-07-21 | 2026-07-28 09:00 UTC | OverdueOverdue 6h |
| DSR-301 | access | Northwind Logisticsacct-northwind | 2026-07-23 | 2026-07-29 15:00 UTC | due-soonDue in 1d 0h |
| DSR-295 | portability | Cirrus Mediaacct-cirrus | 2026-07-25 | 2026-08-01 15:00 UTC | on-trackDue in 4d 0h |
Retention and transfer policy
Retention
Operational telemetry retained 90 days; billing records 7 years; audit ledger immutable and indefinite.
Cross-border transfers
EU/APAC data planes do not egress to the US plane without a countersigned DPA and explicit consent.
Regulatory changes
linked to compliance frameworks| Change | Regime | Effective | Impact | State | Frameworks |
|---|---|---|---|---|---|
| REG-41Updated availability reporting for regulated sectorsTighter outage notification windows. BRCH-1's overdue sector notification traces to this change. | Sector regulator | 2026-10-01 | high impact | remediating | |
| REG-38Cross-border data transfer clause refreshNew standard contractual clauses; the pending Northwind DPA (LEG-4) will adopt them at countersignature. | GDPR | 2026-09-15 | medium impact | assessing | |
| REG-35PHI handling guidance updateBriarcliff scope already isolates the PHI data plane; BAA (LEG-3) reflects the updated guidance. | HIPAA | 2026-06-01 | medium impact | compliant |