Capability
Compliance built into the model, not bolted onto it.
You are the controller and we are the processor. What that means in practice is that the platform gives you controls and evidence rather than reassurance: append-only consent events, an audit trail the application itself cannot delete, erasure that leaves proof without leaving a list, and an exit with a number you can give your own regulator.
Mostly handled before your team hears about it.
Access & portability
The individual downloads everything held about them as machine-readable JSON, from their own portal. Credential material is excluded from the export.
Rectification
Contact details, addresses and preferences are directly editable by the person, so a correction does not need a ticket to become true.
Erasure
Self-service, scoped to your tenancy. Their record with any other tenant is untouched, and the underlying record is deleted once the last tenant erases.
Consent history
The full record of what was given and withdrawn, when, and by what mechanism — available to the person and through the API.
Objection & withdrawal
Withdrawal is exactly as easy as giving consent: the same toggle, the same portal, no extra steps. That is the legal test, and it is met by construction.
The one-month deadline
Self-service materially helps you meet Article 12(3), because the data subject does not have to wait on your team to act at all.
Proof of erasure that does not become a suppression list.
Erasing writes a minimal tombstone: a UUID, a tenant and a timestamp. No name, no address, no reason. Reading an erased record returns HTTP 410 with the erasure date rather than 404, so your own downstream systems can tell 'deliberately removed' from 'never existed' and stop asking.
A resumable, tenant-scoped feed lists what to purge, oldest first, so reconciliation across your estate is ordered rather than guessed. And because nothing identifiable is retained, the feed cannot be used to match an inbound record — it is proof of erasure, not a list of erased people.
- One tenant can never learn that another tenant erased somebody
- Sessions for that person in your tenancy are revoked and outstanding setup links invalidated
- Consent events and audit records survive erasure under Article 17(3) and hold no directly identifying fields
- Campaign send rows are kept with the person identifier nulled, so historical counts do not silently change
The default outcome of a DSAR review is disclose.
An opinion recorded about a person is that person's personal data. A blanket 'internal notes are never shared' rule is easier to operate and considerably harder to defend, so the platform does the defensible thing instead: internal notes are flagged for review, and disclosure is the default outcome.
Withholding requires a reviewer to choose a specific statutory ground and record why. The response tells the data subject that something was withheld and the general grounds — never the content, never which note — so they can challenge it. Decisions are append-only and cannot be edited afterwards, which is exactly what makes them evidence that the request was considered properly.
- Grounds available: third-party data, legal privilege, negotiations, management forecasts, crime prevention, regulatory functions
- Seeing internal notes is a separate capability from seeing notes at all
- The Data Protection Officer role can read across the record including internal notes, and holds no write access at all
- If the person is erased while a review is pending, the erasure wins and the review is cancelled
What is kept, and for how long.
The platform does not auto-expire your person records. Setting a retention period is your obligation as controller; these are the platform's own defaults for everything else.
| Data | Default |
|---|---|
| Person records and preferences | Retained until you erase them — the platform sets no period |
| Consent events | Retained through erasure, as your evidence of lawful processing |
| Audit logs | 400 days, deliberately longer than the platform default of 30 |
| Consumer sessions | 30 days from last use |
| One-time setup links | 7 days by default, 30 days maximum |
| Common-logon handoff tokens | 15 minutes, non-renewable |
| Backups and point-in-time recovery | 7 days |
| Audiences | 30 days by default |
| Offboarded tenancy | 30 days read-only, then deletion; residual copies clear within 9 days |
An exit designed before it was needed.
Two pieces of this cannot be retrofitted, so they were built first. Each tenant's audit log is routed to its own bucket from the moment the tenant is created — because a sink only routes what arrives after it exists, and audit written before routing exists can never be deleted. And retention settings are applied at creation time, because a soft-deleted object cannot be purged early however the policy changes afterwards. A tenant is now not created at all if its log routing fails.
The rest is a lifecycle: a complete export, then thirty days read-only, then deletion, with a certificate. Deletion runs on a scheduled sweep capped at one tenant per tick, behind two independent locks and a kill switch that needs no deployment — because it is the only code on the platform that destroys a whole tenancy unattended.
- A tenant who makes no delete-or-return choice gets an export and a timer rather than silence
- Your books are deleted with everything else: the statutory obligation to retain accounting records is yours, so what is owed here is a complete handover
- Nothing is deleted without either being exported or being named, with a reason, as deliberately not exported
- Nine days is the number for your data processing agreement — a two-day analytics time-travel minimum plus seven non-configurable fail-safe days
What stays with you
A processor claiming to handle all of this would be a processor that has not read the regulation.
- Determining your lawful basis and publishing a privacy notice that reflects it.
- Executing the data processing agreement before any live personal data is processed.
- Deciding retention periods — the platform gives you the controls, not the decision.
- Verifying the identity of anyone asking for an export or an erasure. The platform cannot do this for you.
- Completing a data protection impact assessment where one is required, and keeping your own Article 30 record.
- Notifying your supervisory authority within 72 hours of a breach and affected individuals where required.
- Article 8 controls for children's data — there is no age verification or parental consent mechanism here.
- Assessing WhatsApp one-time-passcode delivery separately before enabling it, because it transfers a phone number outside the EEA.
Questions about governance
Who is the controller and who is the processor?
You are the controller for the personal data you process on the platform. We are the processor. Google Cloud is a sub-processor providing infrastructure only, with no independent purpose, under the published Google Cloud data processing addendum. A data processing agreement is executed before any live personal data is processed.
Who are the sub-processors?
Google Cloud for infrastructure, storage and compute in EEA regions, and Cloudflare for DNS, delivery and firewall at the global edge — transit only, not at rest. Optionally, and only if you enable them: Google, Microsoft, Meta or X for social sign-in, which sees an authentication identifier rather than preference data; and Meta WhatsApp Business for passcode delivery, which does transfer a phone number outside the EEA and is flagged for you to assess.
Is the audit trail tamper-proof?
Tamper-resistant, which is the accurate word. The application's runtime service account holds the log-writer permission and no delete permission, so somebody who fully compromised the application could not erase their tracks. The platform keeps its own copy regardless of tenant configuration, and audit entries never contain the values of personal data — only who did what, to which record, and when.
Does the export find everything?
It finds everything linked to the record, which is the overwhelming majority. It does not find free text in a note or task that mentions somebody without a record link, so for a thorough response you should search text separately rather than assume the export is exhaustive. We would rather tell you that than let you find out during a complaint.
Related capabilities
Including the ones you expect a vendor to dodge. Our compliance attestation lists its open items rather than its closed ones, and we are happy to go through them.