This DPIA is conducted in accordance with GDPR Art. 35. A DPIA is required when processing is likely to result in a high risk to the rights and freedoms of natural persons.
claimio processing meets multiple Art. 35(3) criteria:
| Criterion | Applicable | Reason | |-----------|-----------|--------| | Systematic and extensive evaluation of personal aspects (profiling) | Partial | AI photo analysis for fraud detection assesses claim photos | | Large-scale processing of special categories (Art. 9/10 data) | No | No health data, criminal data, etc. processed by default | | Systematic monitoring of publicly accessible areas | No | — | | Large-scale processing of regular personal data | Yes | Multi-tenant platform; claimant PII at scale | | Use of new technology | Yes | HMAC-SHA256 blind indexing; auditPic deepfake detection (Hive AI) |
Conclusion: DPIA is required.
This DPIA covers claimio version 1.x, including:
| # | Operation | Description | |---|-----------|-------------| | 1 | User registration | Claimant creates account (email, password) per tenant | | 2 | Claim submission | Claimant fills structured form: incident details, vehicle info, third-party info, IBAN | | 3 | Photo capture & upload | Photos signed by auditPic (SHA-256 + HMAC); deepfake detection via Hive AI | | 4 | Reviewer assessment | Insurer REVIEWER/ADMIN views claim data and photos; updates status | | 5 | Data retention | Nightly anonymisation of claims older than retention period | | 6 | Backup | Nightly pg_dump to S3 with 90-day retention; Object Lock immutability |
| Data Category | Fields | Legal Basis | Retention | |--------------|--------|-------------|-----------| | Identity | Name (via claim context) | Art. 6(1)(b) — contract | Per tenant config (default 7 years) | | Contact | Email (encrypted + hash index) | Art. 6(1)(b) — contract | 7 years | | Financial | IBAN (encrypted at rest) | Art. 6(1)(b) — contract | 7 years | | Vehicle | License plate, make, model | Art. 6(1)(b) — contract | 7 years | | Incident | Location, description, date/time | Art. 6(1)(b) — contract | 7 years | | Third party | Name, license plate, insurer | Art. 6(1)(f) — legitimate interest (fraud prevention) | 7 years | | Photos | Claim photos (potentially contains faces) | Art. 6(1)(b) — contract | 7 years | | Authentication | Hashed password (bcrypt), refresh tokens | Art. 6(1)(b) — contract | Session duration; tokens purged on logout | | Technical | IP address (rate-limiting Redis counter) | Art. 6(1)(f) — security | Ephemeral (Redis TTL ~1 min) | | Audit | Actor, action, timestamp, field changes | Art. 6(1)(c) — legal obligation (insurance regulation) | 7 years |
Claimant (Flutter app)
│ HTTPS (TLS 1.3)
▼
claimio API (Spring Boot) — port 8094
│
├──► PostgreSQL (in-cluster) — PII encrypted AES-256-GCM at rest
│
├──► Redis (in-cluster) — rate limit counters only; no PII
│
├──► auditPic (cluster-internal) — photo bytes + metadata → signed hash returned
│ └──► Hive AI (external) — photo for deepfake detection
│
└──► TransIP Object Store (S3) — encrypted pg_dump backups
Insurer REVIEWER (web/Flutter dashboard)
│ HTTPS (TLS 1.3)
▼
claimio API — returns claim data + signed photo URLs
| Recipient | Relationship | Data Shared | |-----------|-------------|-------------| | Insurer (tenant) | Controller-to-Controller (tenant data) | All claim data for their claimants | | auditPic | Processor | Photo bytes, metadata | | Hive AI (via auditPic) | Sub-processor | Photo bytes for deepfake detection | | TransIP | Processor | Encrypted data at rest in VPS + Object Store |
Each data field is assessed for necessity:
| Field | Necessary? | Justification | |-------|-----------|---------------| | Email | Yes | Account authentication; breach notification | | IBAN | Yes | Payment processing for claim settlement | | License plate | Yes | Vehicle identification for damage assessment | | Incident description | Yes | Core claim information | | Third-party IBAN | No | Not collected — only name, plate, insurer | | GPS coordinates of incident | No | Not collected — free-text location only | | Device fingerprint | No | Not collected |
DataRetentionService) nulls PII fields after retention period; claim skeleton (ID, status, dates, tenant) is preserved for audit| Processing | Legal Basis | Assessment | |-----------|-------------|------------| | Claim intake and storage | Art. 6(1)(b) — contract | Claimant enters into service to file a claim; processing is necessary to perform that service | | Photo deepfake detection | Art. 6(1)(f) — legitimate interest | LIA: fraud prevention is legitimate interest of insurers; minimal privacy intrusion (no biometric profiling) | | Third-party data | Art. 6(1)(f) — legitimate interest | Necessary to record counter-party; data minimised | | Audit logging | Art. 6(1)(c) — legal obligation | Dutch insurance law requires audit trail | | IP rate limiting | Art. 6(1)(f) — legitimate interest | Security measure; ephemeral; minimal impact |
| # | Risk | Likelihood | Impact | Risk Level | Controls | |---|------|-----------|--------|------------|---------| | R1 | Unauthorised access to PII (data breach) | Low | High | High | AES-256-GCM encryption at rest; TLS in transit; JWT auth; rate limiting; least-privilege DB user | | R2 | IBAN exposure enabling financial fraud | Low | Very High | High | IBAN encrypted at rest; only exposed to authenticated REVIEWER/ADMIN; audit log on access | | R3 | Photo manipulation post-submission (claim fraud) | Low | High | High | auditPic SHA-256 + HMAC-SHA256 signing; tamper detection | | R4 | Deepfake/AI photo accepted as genuine | Low | High | High | Hive AI deepfake detection integrated via auditPic | | R5 | Insider threat (rogue tenant admin) | Very Low | High | Medium | Tenant isolation; audit log on all actions; no cross-tenant data access | | R6 | Backup compromise | Very Low | Very High | Medium | S3 Object Lock (COMPLIANCE mode); backups encrypted at rest | | R7 | Email enumeration via registration endpoint | Medium | Low | Medium | Rate limiting (5 req/min on login and register endpoints); response timing normalised; HMAC blind index prevents plaintext DB exposure | | R8 | JWT token theft | Low | High | Medium | Short TTL (24h); refresh token rotation; logout invalidation; rotation workflow available | | R9 | Third-party data breach (TransIP/auditPic) | Very Low | High | Medium | DPA agreements; data encrypted; minimal exposure | | R10 | Excessive data retention | Medium | Medium | Medium | Automated nightly retention job; configurable per tenant; Object Lock prevents early deletion | | R11 | Data subject rights request not fulfilled | Low | Medium | Low | Manual process documented in incident procedure; self-service endpoint planned Q3 2026 |
After controls:
| Risk | Residual Level | Acceptable? | |------|---------------|------------| | R1 — Unauthorised access | Low | Yes | | R2 — IBAN exposure | Low | Yes | | R3 — Photo manipulation | Low | Yes | | R4 — Deepfake | Low-Medium | Yes (ongoing monitoring) | | R5 — Insider threat | Low | Yes | | R6 — Backup compromise | Very Low | Yes | | R7 — Email enumeration | Low | Yes | | R8 — JWT theft | Low | Yes | | R9 — Third-party breach | Low | Yes (pending DPAs) | | R10 — Excessive retention | Low | Yes | | R11 — DSR fulfillment | Medium | Partial — self-service endpoint planned Q3 2026 |
Overall residual risk: Acceptable — no high residual risks remain after implemented controls.
| Right | Art. | Status | Implementation | |-------|------|--------|----------------| | Right to information | 13/14 | ✅ | Privacy notice to be included in Flutter app onboarding | | Right of access | 15 | 🔶 | Manual process via DPO; no self-service portal | | Right to rectification | 16 | ✅ | Claimant can update claim data before submission | | Right to erasure | 17 | 🔶 | Manual deletion by admin; self-service endpoint planned Q3 2026 | | Right to restrict processing | 18 | 🔶 | Manual process | | Right to data portability | 20 | 🔶 | Manual export; no self-service endpoint | | Right to object | 21 | ✅ | Legitimate interest processing; opt-out available | | Rights re automated decisions | 22 | ✅ | No solely automated decisions with legal effect; human reviewer always in loop |
| Item | Detail | |------|--------| | DPO consulted | [TBD — DPO contact to be filled in] | | Date of consultation | 2026-03-30 | | DPO opinion | Pending formal sign-off | | DPO recommendations | Prioritise self-service data deletion endpoint; implement privacy notice in app |
Based on the residual risk assessment, prior consultation with the Autoriteit Persoonsgegevens (AP) is not required — all residual risks are acceptable and appropriate technical and organisational measures are in place.
If risk R11 (DSR fulfillment) is not resolved by Q3 2026, this assessment must be revisited.
| # | Measure | Status | Due |
|---|---------|--------|-----|
| 1 | AES-256-GCM PII encryption at rest | ✅ Implemented | — |
| 2 | HMAC-SHA256 email blind index | ✅ Implemented | — |
| 3 | bcrypt password hashing | ✅ Implemented | — |
| 4 | JWT short-lived tokens + refresh rotation | ✅ Implemented | — |
| 5 | Rate limiting on auth endpoints | ✅ Implemented | — |
| 5a | Log PII sanitisation (PiiMaskingConverter) | ✅ Implemented | — |
| 6 | auditPic photo signing (tamper detection) | ✅ Implemented | — |
| 7 | Nightly data retention/anonymisation | ✅ Implemented | — |
| 8 | Immutable off-site backups (S3 Object Lock) | ✅ Implemented | — |
| 9 | Privacy notice in Flutter app onboarding | ❌ Planned | Q2 2026 |
| 10 | Self-service data deletion endpoint | ❌ Planned | Q3 2026 |
| 11 | DPA with TransIP | ❌ Planned | Q2 2026 |
| 12 | DPA with auditPic entity | ❌ Planned | Q2 2026 |
| 13 | MFA for REVIEWER/ADMIN roles | ❌ Planned | Q3 2026 |
This DPIA must be reviewed:
| Version | Date | Author | Changes | |---------|------|--------|---------| | 1.0 | 2026-03-30 | GloryLabs | Initial version | | 1.1 | 2026-04-14 | GloryLabs | R7 rate limit corrected to 5 req/min. Measure 5a (log PII sanitisation) added as implemented. |
Reacties