GDPR

Start by identifying the personal data your integration will send and the purpose for sending it. Your privacy and legal teams determine the processing roles and obligations.

Approve the processing purpose, data fields, region, retention, subprocessors, and agreement before sending personal data.

Assign responsibilities

Your organization decides why the AI system processes personal data and which data VeriProof receives. Document the controller, processor, and subprocessor roles in the approved agreement.

Do not infer these roles from the product interface. Confirm them with your privacy and legal teams.

Minimize captured data

The SDK sends the attributes and content that your integration records. Before deployment:

Inventory the fields each adapter can capture.
Remove data that is not required for the governance purpose.
Configure supported redaction and sensitive-field controls.
Test the resulting records with representative non-production data.

Pattern-based redaction is a supporting control. It does not identify every form of personal data.

Configure access and retention

Use role-based access to limit who can view applications, sessions, evidence, and settings. Select retention settings that match your approved purpose and legal obligations.

Record legal holds and deletion requirements in the operating procedure for the deployment. Use only the deletion and export workflows available in the selected release.

Support access and evidence requests

Evidence exports can support an authorized review of records in scope. They do not replace your identity verification, response process, exemptions, or legal assessment.

Validate the exported fields before relying on them for a data subject request. Assess rights and exceptions against the GDPR text , not an export status.

Review data location and providers

Data location and replication depend on the approved Azure deployment. Integrity records may use Azure SQL Ledger or Solana, according to the configured proof provider.

Review the provider, region, support-access model, and subprocessor terms during solution design. See Deployment context and Proof providers.

Confirm contractual terms

Use the enterprise inquiry form to confirm available data-processing terms and the current subprocessor list.

The signed agreement, not this guide, governs the processing relationship and notification commitments.

Review checklist

Processing purpose and lawful basis are documented.
Captured fields and redaction behavior are tested.
Region, replication, proof provider, and subprocessors are approved.
Roles and permissions match job responsibilities.
Retention, export, deletion, and legal-hold procedures are documented.
Required agreements are signed before personal data is sent.