The Privacy-First Enterprise Kernel.
Compliance is not a legal document; it is a technical reality. Aeion OS automates global data protection (GDPR, CCPA) directly at the database layer. Utilizing the `gdpr-strict` profile, cryptographic anonymization, and an automated Right-to-Erasure cascade, Aeion ensures that your enterprise inherently respects data sovereignty.
Mathematical Privacy Guarantees
The `gdpr-strict` Profile
Locking a session into `gdpr-strict` activates immediate runtime constraints. It pins the data processing pipeline strictly to approved EU regions (e.g., `eu-central-1` on AWS or `fsn1` on Hetzner), mathematically preventing accidental data egress to the United States or unauthorized zones without an explicit Transfer Impact Assessment (TIA).
Automated Right-to-Erasure
When a user invokes Article 17, manual deletion is prone to failure — someone always forgets a table, a backup, or a webhook log. Aeion removes the guesswork: within 60 seconds, it automatically hunts down every record, transcript, and recording the user ever touched, and performs in-place redactions and media hard-deletes across the entire system — no engineer writing one-off SQL under deadline pressure.
Cryptographic Anonymization
Deleting data often breaks relational database integrity. Rather than dropping rows outright, Aeion anonymizes them — identifying fields like IP, email, and user-agent are hashed and replaced with a redacted marker, preserving the structural integrity of your analytics and consent trails (Article 7) while completely destroying the link back to the person.
Sub-Processor Flow-Down
If an AI agent joins a `gdpr-strict` session, it's automatically blocked from sending voice or text data to any LLM or TTS provider that isn't explicitly covered by an executed Data Processing Agreement (DPA) or Standard Contractual Clauses (SCC) — so a well-meaning integration can't quietly become a compliance incident.
Immutable Audit Trails
The GDPR demands proof, not promises. Aeion logs every access and deletion event to an append-only audit ledger and cryptographically signs each row with an HMAC-SHA256 signature — so you can prove to EU regulators, with math instead of good faith, that a deletion actually happened and the trail wasn't altered afterward.
Consent Capture Ledger
Every session join forces explicit user consent, captured to an append-only ledger nobody — not even an admin — can quietly edit later. Even after a user deletes their account, the anonymized timestamp of their original consent is preserved to prove compliance.
The Data Processing Agreement (DPA)
Pre-Mapped Article 28 Compliance
Aeion OS provides a comprehensive DPA template mapped directly against GDPR Articles 28 and 32. It covers the exact Technical and Organisational Measures (TOMs)—such as AES-256-GCM encryption and TLS 1.3—enforced by the OS, drastically accelerating your legal team's RFP and vendor assessment workflows.
GDPR Article Mappings — Every Right + Every Obligation
Art. 5 — Principles (lawfulness, purpose limitation, integrity)
Schema-level access guards, audit log, and retention enforcement.
Art. 6 — Lawful basis for processing
Per-collection consent records linked to processing purpose.
Art. 7 — Conditions for consent
Append-only consent ledger — proves explicit opt-in.
Art. 12 — Transparent information
Per-tenant privacy notice templates + cookie banner via the Content module.
Art. 13/14 — Information to be provided
Self-serve data subject portal (Pro+).
Art. 15 — Right of access
One-click data export — a JSON bundle of every record linked to the user across all 45+ modules.
Art. 16 — Right to rectification
Self-serve via portal, plus an audit log of every change.
Art. 17 — Right to erasure ("right to be forgotten")
An automated purge-and-anonymization cascade — see the walkthrough below.
Art. 18 — Right to restriction
A per-record processing-restriction flag that suspends all module integrations touching that record.
Art. 20 — Right to data portability
Machine-readable JSON export aligned with the Aeion API schema.
Art. 21 — Right to object
Opt-out toggles per processing purpose (marketing, analytics, AI training).
Art. 22 — Automated decision-making + profiling
All AI decisions audit-logged with a human-review path.
Art. 25 — Data protection by design + by default
Fail-safe-by-default access control + auto tenant scoping — a privacy-preserving baseline.
Art. 28 — Processor obligations + DPA
Pre-filled DPA template covering all TOMs + sub-processor list.
Art. 30 — Records of processing activities (ROPA)
Auto-generated ROPA from registered collections + their processing purpose tags.
Art. 32 — Security of processing
AES-256-GCM at rest, TLS 1.3 in transit, Aegis backup, 3-stage RBAC, and signed audit logs.
Art. 33 — Breach notification (72 hours)
Automated incident triggers notify the DPO + affected customers within minutes of detection.
Art. 35 — Data Protection Impact Assessment (DPIA)
Pre-filled DPIA template + automated risk score from access patterns.
Art. 44-49 — Transfers outside the EU
Region-pinned deployment + SCC + DPF (EU-US Data Privacy Framework) certification on request.
The Right-to-Erasure Cascade — Line by Line
When a user invokes their Article 17 right to erasure, manual SQL is brittle and incomplete. Aeion's purge cascade is structured + audited + reversible (during a grace window):
Step 1 — Identification. A resolver finds every record across every collection that references the user, using a reverse-link index built into the schema engine for fast lookup — no engineer has to guess which of 45+ modules the person ever touched. Records are categorized into:
- Delete candidates — records whose primary owner is the user (e.g., their private notes, their personal calendar entries)
- Anonymize candidates — records the user touched but doesn't own (e.g., commerce orders, audit log rows, message threads)
- Retain candidates — records subject to legal hold (e.g., financial transactions under tax retention law, healthcare records under HIPAA minimum-necessary)
Step 2 — Preview. The cascade produces a structured preview report: 12 records to delete, 47 to anonymize, 6 retained-by-law (with the specific legal basis cited). Operator reviews + approves.
Step 3 — Grace window. A 7-day grace window starts. During this window the purge is paused — the user can rescind their request, or the DPO can detect a malicious-cancel attack. The user's account is suspended (no logins), but data is intact. This satisfies Art. 17(3) "compelling legitimate grounds" by giving the controller a window to verify.
Step 4 — Cascade execution. After the grace window, the cascade runs:
- Anonymization. Identifying fields (
email,name,phone,ip,userAgent) replaced with cryptographic hashes. Structural relationships preserved — the record still says "Customer XYZ123 placed Order 5678 at 2026-03-15" — but XYZ123 can never be linked back to a person. - Hard delete. Records flagged for delete are removed from Postgres + their S3 attachments deleted with provider-side
purge(Object Lock honored if retention not yet expired). - Temporal log purge. The user's appearance in Aeion's version-history log is anonymized too — reconstructing a past version still works, but it contains anonymous hashes, not PII.
- Audit log retention. The erasure ITSELF is logged — Art. 30 ROPA needs proof the request was processed. The audit row references the user by hash, not by identity.
Step 5 — Notification. DPO receives a signed completion report. Sub-processors (Stripe, SendGrid, etc.) get parallel erasure requests via their APIs. The user (if they provided a recovery email separate from their account email) gets a confirmation.
Step 6 — Sub-processor verification. Within 30 days, Aeion's GDPR audit cron re-checks each sub-processor's API to confirm the user's data is gone there too. If any provider hasn't completed, the DPO is notified.
Data Residency — Region-Pinned Deployments
EU-only deployment
Choose `region: "eu"` on tenant creation, and every replica, backup, queue, and AI inference endpoint pins to AWS `eu-central-1` (Frankfurt) / `eu-west-1` (Dublin), GCP `europe-west1` (Belgium), or Hetzner `fsn1` (Falkenstein) / `nbg1` (Nuremberg) — no data quietly drifts to a US region later.
Per-collection pinning
Even on a non-EU deployment, individual collections can pin EU-only — useful when a European customer subset lives on a primarily US deployment.
Cross-region transfer guards
When `gdpr-strict` is active, the kernel structurally refuses to write to any storage backend not on the allowed-region list. A misconfigured cross-region replication setting is rejected at validation time — before the data ever moves, not after.
AI provider gating
A sub-processor allowlist decides which AI providers are even reachable. When `gdpr-strict` is on, calls only go to providers with EU data-residency commitments and executed Standard Contractual Clauses (SCC) — currently AWS Bedrock EU and Azure OpenAI EU. There's no silent fallback to a US-resident endpoint.
DPF (EU-US Data Privacy Framework)
For necessary US-resident workloads (e.g., Stripe US for cross-border payments), Aeion checks the provider's DPF certification status before allowing the call. Providers without current DPF certification get a hard block and a compliance alert.
Audit trail
Every cross-region write logs to the residency audit trail with its legal basis (SCC, DPF, derogation), so your DPO can review it at any time.
Breach Notification — Article 33 in 72 Hours, Automated
Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach. Manual incident response often misses this clock. Aeion automates the chain:
Trigger sources:
- Authentication anomaly detection (unusual login pattern, brute-force, credential stuffing)
- Aegis verification failure (backup couldn't be restored — possible data corruption / integrity loss)
- Schema-snapshot drift (unexpected schema change)
- High-severity RBAC violation (admin permission grant from unauthorized source)
- Manual report via DPO portal
Auto-cascade on trigger:
- Incident record created — immutable once written. T+0.
- DPO notification via priority-routed Notification rule (email, SMS, Slack, PagerDuty). T+1 min.
- Affected-tenant identification. The incident classifier reads the trigger context and identifies which tenant(s) + which subjects are affected.
- 72-hour clock starts. Visible in the DPO dashboard with a countdown.
- Pre-filled supervisory authority notification. Template populates with: nature of breach, categories + approximate number of subjects affected, categories + approximate number of records, likely consequences, measures taken.
- At T+24h: if the incident isn't manually closed or escalated, the DPO + their backup contact gets a "still open" reminder.
- At T+60h: the system surfaces a "you must notify within 12 hours" alert to all admins on the tenant.
- At T+72h: if no resolution, the system auto-emits a
gdpr.breach.deadline_passedevent for the DPO to handle accordingly (typically: submit the notification with whatever info is available).
Affected-subject notification (Art. 34) runs in parallel for breaches likely to result in high risk to subjects' rights. Templates configurable per tenant.
Frequently Asked Questions
Records the user **owns** (their private notes, their account record) are hard-deleted. Records they **touched** but don't own (commerce orders, audit log rows, message threads) are anonymized — identifying fields hashed, structural relationships preserved. This is essential for analytics + financial records that legally must be retained (e.g., tax retention rules) but where the user's PII shouldn't be recoverable.
Yes. The 7-day grace window is configurable per tenant. During the window, the account is suspended (no logins, no API access), but data is intact. The user can rescind via a magic link, or the DPO can manually halt. Day 8: cascade runs. This satisfies Art. 17(3)(b) "compelling legitimate grounds" by ensuring the request is genuine.
Retention policy enforces minimum retention windows per data category. Financial transactions retain 7 years (US IRS, EU equivalents). Healthcare records retain per HIPAA + state law. When erasure conflicts with retention, the system anonymizes (removes PII) but preserves the record + cites the legal basis. The DPO sees this in the preview report — they can confirm or escalate.
On Pro+ the erasure cascade fires parallel API requests to all registered sub-processors. Each provider's API documentation declares its erasure endpoint; Aeion's adapter calls it with the user identity. A 30-day verification cron re-checks each provider to confirm completion. If a provider doesn't complete (some legacy systems are slow), the DPO gets notified.
The same architecture supports CCPA (California), LGPD (Brazil), PIPL (China), POPIA (South Africa), PDPA (Singapore + others), KVKK (Turkey), CDPA (Virginia, Colorado, Connecticut, Utah). The mechanisms — region pinning, consent capture, erasure cascade, audit trail — are jurisdiction-agnostic. We provide pre-mapped compliance templates for each.
All AI decisions emitted by Aeion modules write to the audit log with the model used, the prompt, the response, and the user's review status. Articles 22(3) requires a human-review path for high-impact decisions; Aeion's workflow engine supports a `human-review` gate on any AI output. For high-stakes decisions (loan approval, medical triage), this is mandatory; for low-stakes (autocomplete suggestion), it's optional. Configurable per collection.
Three paths. (1) **Pin to EU region** — data never leaves the EU, no transfer at all. (2) **Standard Contractual Clauses (SCC)** — for necessary US transfers (e.g., Stripe US), Aeion provides the SCC-compliant DPA. (3) **DPF (EU-US Data Privacy Framework)** — for providers certified under the 2023 DPF, transfers are allowed without SCC. Aeion's sub-processor gate checks DPF status at runtime; uncertified providers are blocked.
Yes — audit log entries reference users by hash after erasure, not by identifying fields. Pre-erasure audit rows are anonymized as part of the cascade. The signed-HMAC chain remains intact (hashes are deterministic, so signature verification still works). Auditors can prove "an erasure occurred on this date" without recovering the identity.