Skip to content

Privacy-rights operations

Status: Current | Last reviewed: 2026-08-30

The privacy control plane supports verified access, portability, rectification, deletion, objection, restriction, and sale or sharing opt-out requests. It uses a tenant-keyed HMAC for subject lookup and never stores the submitted raw identifier.

State flow

pending_verification moves to verified, then automated requests move to in_progress and a terminal state. Rectification moves from verified to completed through an authenticated operator attestation. Database triggers reject all other transitions, deadline changes, cross-tenant conversations, nonmember requesters or verifiers, and inconsistent receipts.

  1. Create a request with POST /api/privacy/requests.
  2. Verify identity through the approved procedure, then call POST /api/privacy/requests/{requestId}/verify with a non-sensitive evidence reference.
  3. The worker claims access, portability, deletion, objection, restriction, and opt-out work. A stale in_progress lease becomes eligible again.
  4. For rectification, correct the authoritative record through its owning service. Call POST /api/privacy/requests/{requestId}/complete with completion evidence and 1 to 100 record references. Do not place raw personal data in the evidence string.
  5. Review the append-only request events and compliance audit event.

Automated behavior

  • Access and portability produce a deterministic JSON export of matching conversations, messages, events, recordings, attachments, and archive references. The application-data lifecycle expires privacy exports after 30 days.
  • Deletion discovers database rows and S3 references, checks active subject or conversation legal holds, deletes all exact object versions and delete markers, records immutable tombstones, then deletes the conversation rows.
  • Opt-out writes the sale_or_sharing preference.
  • Objection writes the processing_objection preference.
  • Restriction writes the processing_restriction preference.
  • A legal hold denies deletion and records the hold count without exposing the matter details in the compliance event.

Required operator integrations

The worker owns the TrueServe conversation database and configured application bucket. Customers must register and operate deletion, export, correction, or preservation actions for external CRMs, knowledge stores, analytics systems, telemetry destinations, model providers, contact centers, backups, and other subprocessors. A profile must not be activated if an in-scope processor lacks a working procedure and evidence receipt.

After restoring a backup, reconcile every privacy_erasure_tombstones record before reopening regulated traffic. Verify that restored database content, object versions, derived indexes, caches, and downstream processors do not resurrect erased data.

Monitoring

Alert on open requests near due_at, stale leases, failures, legal-hold denials, missing external receipts, and exports older than the delivery window. Privacy or legal owners must define jurisdiction-specific verification, deadlines, appeals, exceptions, sensitive-data handling, Global Privacy Control intake, and non-discrimination procedures.