Compliance: GDPR Art.5(1)(f)/Art.25/Art.32, BIO A.6.2, NIS2 Art.21(2)(i) Owner: GloryLabs Review cycle: Annual or when onboarding new staff

1. Scope

This document covers:

Auditor privacy briefing — what auditors (external parties using AuditPic to verify photos) need to know about how their data is processed.
Staff training requirements — what GloryLabs team members must complete before handling AuditPic production data.
Mobile Device Management (MDM) guidance — minimum security requirements for devices used to access production systems.

2. Auditor Privacy Briefing

When an auditor accesses the GET /api/v1/photos/{verificationId} endpoint or uses the app's verification flow, they are presented with photo metadata (SHA-256 hash, capture timestamp, AI detection result). The following applies:

What data is processed about auditors

The verification ID used — logged server-side for audit trail purposes.
IP address — logged by the Spring Boot access log filter (retained 90 days).
No account is required; no personal profile is created for anonymous verifiers.

Purpose & legal basis

| Purpose | Legal Basis | |---------|-----------| | Verify photo authenticity | Legitimate interest of the photo owner (GDPR Art.6(1)(f)) | | Fraud prevention / integrity audit trail | Legitimate interest (GDPR Art.6(1)(f)) |

Auditor rights

Auditors (data subjects) have the right to request erasure of access logs by contacting GloryLabs at the address in the app's Privacy Policy. Requests are honoured within 30 days.

Data transfers

AuditPic is hosted on a VPS in the Netherlands (TransIP). No data is transferred outside the EEA in normal operation. If AI detection via Hive Moderation is enabled, photo bytes are transmitted to Hive's US-based API — ensure users have been informed via the Privacy Policy and an appropriate transfer mechanism (SCCs) is in place before enabling AI_DETECTION_ENABLED=true in production.

3. Staff Training Requirements

All GloryLabs team members with access to AuditPic production infrastructure (VPS SSH, k3s, 1Password vault, production database) must complete the following before access is granted:

3.1 Mandatory Training Modules

| Module | Provider | Frequency | |--------|---------|-----------| | GDPR Fundamentals | Internal (see docs/training/gdpr-fundamentals.md) | Onboarding + annual refresh | | Secure Development Practices | Internal (OWASP Top 10 walkthrough) | Onboarding + annual refresh | | Incident Response Procedure | This repository (docs/incident-response.md) | Onboarding + after any incident | | Password & Secrets Management | 1Password team onboarding guide | Onboarding |

3.2 Training Records

Training completion is recorded in the reports/training/ directory with the following fields:

Staff member: [name or pseudonym]
Module: [module name]
Completion date: [YYYY-MM-DD]
Trainer / platform: [name or URL]
Expiry date: [YYYY-MM-DD]

Records are retained for the duration of employment plus 3 years.

3.3 Access Revocation

When a team member leaves GloryLabs:

Remove from 1Password vault within 24 hours.
Rotate any shared secrets they had access to (JWT_SECRET, HMAC_SECRET, MinIO credentials).
Revoke SSH key from ~/.ssh/authorized_keys on the VPS.
Remove from GitHub organisation.
Document in reports/access-revocations/.

4. Mobile Device Management (MDM) Guidance

Devices used to access production systems (VPS SSH, k3s dashboard, GitHub) must meet these minimum requirements.

4.1 Required Controls

| Control | Requirement | |---------|-----------| | Screen lock | PIN/biometric, ≤ 5 minutes auto-lock | | Full-disk encryption | Enabled (FileVault on macOS, BitLocker on Windows, built-in on iOS/Android) | | OS patching | Within 14 days of security patch release | | Remote wipe capability | Enrolled in an MDM solution or Find My Device enabled | | Approved VPN | Required when accessing production over public Wi-Fi | | SSH key storage | Hardware key (YubiKey) preferred; software key must use a passphrase |

4.2 Prohibited Actions

Storing production credentials in plain-text files (use 1Password).
Accessing the production VPS from a shared or untrusted device.
Installing the AuditPic production app build on a jailbroken/rooted device.
Forwarding production logs to personal email or messaging apps.

4.3 AuditPic App Distribution (Internal Testing)

Internal test builds are distributed via:

iOS: TestFlight (invite-only)
Android: Firebase App Distribution or direct APK over HTTPS (signed)

Testers must acknowledge the data handling terms before installing. Test devices must meet the same MDM requirements as production devices.

5. Privacy by Design Checklist (GDPR Art.25)

Before shipping any new feature that processes personal data, the developer must check:

[ ] Is a new data field necessary, or can an existing field serve the purpose? (data minimisation)
[ ] Is the retention period for the new data defined?
[ ] Is access to the new data limited to the minimum required roles?
[ ] Is the new data included in the Privacy Policy?
[ ] Has a Data Protection Impact Assessment (DPIA) been considered? (required if processing is likely to result in high risk — e.g., biometric data, large-scale profiling)

6. Privacy Policy Location

The AuditPic Privacy Policy is maintained separately and must be linked from:

The app's onboarding screen.
The app's Settings → Privacy menu.
The public-facing website.

Any changes to personal data processing must be reflected in the Privacy Policy before the updated feature ships.

Reacties

Nog geen reacties

Athena — auditPic/privacy-training.md

Privacy, Security Training & MDM Guidance — AuditPic