GDPR Readiness
This page maps HoloSignal product controls to common GDPR obligations. It is operational documentation, not a certification or legal opinion.
| Reference | Obligation | HoloSignal control |
|---|---|---|
| Art. 5 / 25 | Principles and privacy by design | Data minimization, tenant isolation, configurable redaction, retention, and no general-purpose training by default. |
| Art. 6 / 9 | Lawful basis and sensitive data | Customer instructions and source policy; sensitive-data controls; optional processing requires an applicable basis. |
| Art. 12–23 | Data subject rights | Verified access, export, correction, deletion, restriction, objection, portability and consent withdrawal workflow. |
| Art. 28 | Processor terms | DPA, subprocessor list, documented instructions, confidentiality, assistance, deletion/return and audit information. |
| Art. 30 / 35 | Records and DPIA support | Versioned policies, automated processing activity, audit events, processing metadata, risk receipts, and exportable evidence. |
| Art. 32–34 | Security and incidents | Least privilege, encryption in transit, secret isolation, SSRF defense, logging, incident assessment and notification support. |
| Ch. V | International transfers | Transfer mechanisms and supplementary controls; enterprise region configuration where available. |
01
Roles and processing instructions
Customer agreements identify controller and processor roles. Context Pack policy, source allowlists, review rules, retention, and action scopes form part of the customer’s processing instructions.
02
Privacy by design
Personal-data detection and redaction can run before automated processing. Customer content, metadata, and retrieval indexes remain tenant scoped and access controlled; cross-tenant retrieval is prohibited.
03
Data subject requests
Access, export, correction, deletion, restriction, objection and consent withdrawal requests are logged, verified, deadline tracked, fulfilled, and audited. Subprocessor propagation is recorded where applicable.
04
Security and incidents
Controls include least privilege, scoped keys, encrypted transport, secret isolation, immutable snapshots, audit events, SSRF controls, approval-bound writes, dependency pinning and incident response. Customers retain responsibility for their own configuration and lawful basis.
Questions or requests?
Email privacy@holosignal.xyz or use the privacy controls in your workspace. General support is available at support@holosignal.xyz.