Compliance Posture

This document is the single source of truth for CoreOfDiscovery's public compliance posture during the MVP build.

GDPR Posture

Data minimization: Store decision inputs, reasoning trails, calibration outputs, and audit entries needed to provide the product. Do not store raw ERP records long term.
Access and export: Signed-in users export profile, decisions, predictions, trails, audit, and calibration records from Settings → Privacy (`GET /api/v1/me/export`).
Deletion: Soft-deleted decisions remain restorable, then hard-delete after 30 days (`HARD_DELETE_AFTER_DAYS` in `lib/retention.ts` + `/api/cron/hard-delete`). Account deletion uses the privacy settings flow and a 7-day grace window (`ACCOUNT_DELETION_GRACE_DAYS`).
Processor/subprocessor clarity: LLM, auth, database, email, hosting, analytics, and payment subprocessors must be disclosed before production launch.
Lawful basis: MVP assumes user consent and contract necessity for workspace users; enterprise deployments will document DPA terms.

System role: CoreOfDiscovery is a decision-support and calibration tool. It is not an autonomous high-risk decision-maker.
Human oversight: Users keep final authority. AI outputs are badged and editable.
Transparency: The product explains formulas, input factors, AI usage locations, and auto-resolution confidence.
Risk controls: High-stakes workflows use Deep mode, premortem prompts, evidence capture, and audit logs.
Limitations: The product is not legal, medical, financial, or employment advice.

Auditability: Decision mutations write append-only, hash-chained audit events.
Authentication: Clerk Organizations scope workspaces and permissions.
API access: API keys are bcrypt-hashed, scoped, revocable, and copy-once.
Secrets: CI and local scripts scan for committed secrets.
Retention: Production policy targets hard deletion within 30 days unless legally blocked or retained in aggregate/anonymized analytics.