Quickstart: Automate European Privacy
Review the DPA, enable strict mode, capture consent, configure residency, execute erasure cascade, monitor compliance — the full implementation in 6 steps, in under 30 minutes.
Review the Data Processing Agreement
| GDPR Article | What it requires | Aeion's technical control |
|---|---|---|
| Art. 28 | Processor obligations + sub-processor list | Allowlisted AI providers + sub-processor registry |
| Art. 32(1a) | Pseudonymisation + encryption | AES-256-GCM at rest, TLS 1.3 in transit |
| Art. 32(1b) | Confidentiality + integrity | HMAC-SHA256 audit log signing, immutable storage |
| Art. 32(1c) | Restore availability after incident | Aegis backup + PITR + time-travel |
| Art. 32(1d) | Regular testing of effectiveness | Backup verification + penetration test program |
| Art. 17 | Right to erasure | Automated purge-and-anonymization cascade |
| Art. 20 | Data portability | Full data export in machine-readable JSON / CSV |
| Art. 30 | Records of processing activities | Audit log + processing activity registry |
| Art. 33 | Breach notification (72 hours) | Incident-response runbook + auto-notification workflow |
Enable the gdpr-strict Compliance Profile
Navigate to Admin → Compliance → Profile and set the tenant compliance profile to gdpr-strict.
What strict mode enforces (automatically):
- Data residency — at boot, the kernel reads the cloud region. If outside the EU (or your configured allowlist), critical operations are blocked.
- AI provider gating — non-BAA / non-EU AI providers blocked at the gateway. Only allowlisted EU-region providers can process PHI / PII.
- Cross-border transfer policy — outbound API calls to non-EU endpoints automatically refused unless explicitly allowlisted with documented legal basis (SCC + DPF certification).
- Retention policy locks — minimum retention enforced per record type (consent records: 7 years; transcripts: 30 days; recordings: 30 days).
- Encryption mandatory — at-rest + in-transit; weak ciphers (TLS < 1.3, AES-128 in transit) refused.
- Pseudonymisation defaults — new PII fields require either encryption or explicit "pseudonymisable" tag.
Compliance profile is set per-session (Realtime sessions, transcription jobs, AI invocations) and inherited from the tenant default. Configure the tenant default in Admin → Compliance → Profile; per-session overrides happen when the session is created (each module documents the profile field on its session/job creation route).
typescript
// Per-session profile override — Realtime example
await aeion.api.post("/api/realtime/sessions", {
/* ... other session fields ... */
complianceProfile: "gdpr-strict",
});
Mode switch is one-way for production safety. Once gdpr-strict is enabled, you can't accidentally downgrade. Switch back requires support ticket + audit log entry.
Capture Explicit Consent
| Surface | What it captures |
|---|---|
| **Onboarding modal** | Account creation T&Cs + Marketing opt-in + Cookies |
| **Pre-feature modal** | Specific feature consent (e.g., "Allow AI transcription") |
| **Per-channel opt-in** | Email / SMS / phone marketing separately |
| **Cookie banner** | Granular cookie category opt-in (GDPR Cookie Directive) |
| **Per-session modal** | Recording consent before video session starts |
Configure Data Residency
Beyond the strict profile, configure granular residency rules.
Region pinning is configured at the tenant level via the platform deployment topology (Admin → Platform → Tenant Settings → Residency) and enforced by the kernel at boot. Region claims propagate via the compliance profile — when a tenant runs gdpr-strict, the kernel refuses operations that would cross the configured residency boundary.
Per-record residency overrides — for high-sensitivity records (medical, financial), configure to never cross regions even within the EU.
Auto-replication policy:
- Backups stay in-region (BYOB S3 in EU regions for EU tenants)
- Disaster recovery requires explicit cross-region setup (signed off by your DPO)
- Audit trail logs every cross-region operation
Per-feature residency override:
- Some features (e.g., voice transcription) may need a specific provider not available in all regions
- Per-feature residency policy: "Aeion AI gateway: route to azure-openai-eu only"
- If the configured provider has an outage, the feature degrades gracefully (returns to deterministic fallback) rather than secretly routing to a non-EU provider
Execute the Right-to-Erasure Cascade
When a data subject invokes their Article 17 right, do not write custom SQL scripts. Use the built-in erasure cascade.
Cascade workflow:
- Receive the request — email, web form, support ticket, or data subject portal
- Verify identity — confirm the requester is the data subject (typically via email re-verification + secondary identifier)
- Trigger the cascade — Admin → Privacy → Erasure Requests → New → User ID → Execute
- Cascade runs — 5-stage execution across all modules:
- Receipt delivered — to data subject + audit log + your DPO
Aggregate data preserved: the cascade uses "in-place redaction" — PII deleted but record skeletons preserved so your financial dashboards + product analytics stay accurate.
Automating erasure at scale: for high-volume tenants that need to trigger erasure programmatically (rather than one request at a time via the Admin UI), the erasure endpoint accepts the same request shape as the manual flow — target user, reason, and the authorizing operator — and returns a cascade trace with per-collection redaction counts. Realtime and other modules listen for the resulting erasure event and run their own redactors automatically, so you don't have to coordinate module-by-module cleanup yourself.
Sub-60-second execution for typical tenants. Even 5M+ row tenants complete in under 5 minutes.
Monitor Compliance Reporting
Compliance isn't one-and-done. Monitor continuously.
Quarterly compliance reports:
- Auto-generated PDF + JSON every quarter
- Sent to your DPO + legal counsel
- Available in Admin → Compliance → Reports
Report contents:
- GDPR control effectiveness — every control category with evidence
- Erasure request stats — count, average resolution time, exceptions
- Consent metrics — capture rates, withdrawal rates, conversion impact
- Sub-processor changes — any new/removed sub-processors (Art. 28(2))
- Breach incidents — zero target; any incidents with response timeline
- Cross-border transfers — any transfers + legal basis documented
- Data residency proof — quarterly attestation of data location
Real-time alerts:
- Configurable thresholds — alert if erasure request takes > 30 days, alert on first cross-border transfer attempt, alert on consent withdrawal rate spike
- Routes to your DPO + relevant module owners
- Auto-creates Helpdesk tickets for high-severity items
Audit-ready evidence:
- One-click export of any time range for ICO / CNIL / supervisory-authority requests
- Cryptographically signed evidence package (HMAC-SHA256 with rotated keys)
- Machine-readable JSON + human-readable PDF in same package
Integration Recipes
Realtime sessions → GDPR-strict mode. Set compliance: "gdpr-strict" when creating a Realtime session. The platform automatically enforces consent capture before AI transcription, restricts to EU AI providers, and applies retention policies to recordings.
Marketing campaigns → consent gating. Marketing module reads consent records before sending campaigns. A customer who opted out of marketing automatically excluded; consent expiry (7 years for explicit, 2 years for soft opt-in) tracked.
CRM segment-driven retention. Different customer segments may have different retention policies (B2B contacts vs B2C prospects). Configure per-segment retention rules; cascade respects them.
Aegis backup residency. Backups inherit the tenant's data-residency settings. EU tenant backups go to EU S3 buckets (Cloudflare R2 EU, AWS S3 eu-west-1, etc.) — never US-based storage unless explicitly allowlisted with documented SCC.
Forge audit + ADR linkage. When data-processing decisions are made (new AI provider, new sub-processor, retention policy changes), they log as ADRs in Forge with timestamps + signing officer. Auditor-ready.
Sentinel monitoring. Sentinel watches for suspicious patterns — multiple PII access from same user in short window, mass-erasure attempts, unusual export volume. Surfaces to security team via the rule engine.
Troubleshooting
gdpr-strict mode is blocking a feature I need. Check Admin → Compliance → Profile → Blocked Operations. The blocked feature will show its reason (provider not allowlisted, region not allowed, retention conflict). Resolve by either: (1) reconfiguring the feature for compliance, (2) adding an explicit exception with documented legal basis.
Erasure cascade taking unusually long. Common cause: a module with large historical data (e.g., 10M+ marketing events). Check Admin → Compliance → Erasure → [request] → Stage Status. The stage-by-stage view shows where time is being spent. Switch to async cascade for very-large erasures.
Consent record disputed by user. The audit log shows the exact consent text + version + capture context. If the user disputes it, the record stands as primary evidence. If dispute escalates, the cryptographic signing + immutable storage provide tamper-evidence for court use.
Cross-border transfer attempted unexpectedly. Investigate via Admin → Compliance → Cross-Border Log. Common causes: (1) module attempting non-allowlisted external API, (2) sub-processor introduced via dependency update. Block via the profile config + investigate the upstream cause.
Audit log integrity check failed. Critical alert — investigate immediately. Possible cause: storage corruption, intentional tampering, or signing-key rotation issue. The forensic mode shows which rows have integrity violations + when they happened.
Erasure cascade partial completion. If a stage fails, the cascade pauses and surfaces the failure. Resume via Admin → Compliance → Erasure → [request] → Resume. The remaining stages execute. Most common cause: external system (third-party CRM, etc.) unavailable.
Frequently Asked Questions
By default, no. The profile blocks cross-border data egress. However, if you execute Standard Contractual Clauses (SCC) + verify the provider's EU-US Data Privacy Framework (DPF) certification, an Admin can override the allowlist in tenant config to permit specific US sub-processors. Documented legal basis required.
Metrics remain accurate. The erasure cascade uses "in-place redaction" — deletes PII (name, email) but preserves aggregate rows (token usage, transaction amounts) so billing + analytics dashboards continue working.
Under gdpr-strict, default retention window is 30 days. Background cron hard-deletes recordings older than 30 days unless a Legal Hold has been explicitly applied. Recordings tied to ongoing litigation can be held indefinitely.
Yes — Incident Response runbook surfaces an unresolved security incident as a 72-hour countdown timer. If your tenant's DPO doesn't acknowledge by hour 24, a "still open" reminder escalates to your incident-response channel. By hour 60, a draft breach notification is auto-prepared for your DPO to review + send.
Yes. Admin → Privacy → Portability Requests → New. The Portability service exports all of a user's data in machine-readable JSON / CSV with full provenance metadata. Customer-uploadable to another GDPR-compliant service.
Overlapping but not identical. CCPA / CPRA (California) and similar US state laws have different scope, definitions, and rights. Aeion's compliance profile supports each: `gdpr-strict`, `ccpa`, `lgpd` (Brazil), `pdpa` (Singapore). Stack profiles if you serve multiple jurisdictions.
Sub-processor registry in Admin → Compliance → Sub-Processors. Every entity that touches PII is registered with role, region, legal basis, and Aeion's contractual relationship. Updates require admin approval + DPO notification. Audit-ready for ICO / CNIL requests.
Yes — via Singularity connectors. Bidirectional sync of consent records, breach incidents, data-subject requests. Use Aeion's native tooling for the technical execution + the privacy tool for board reporting.
Significantly lower than custom systems. Aeion's audit-ready evidence + immutable signed audit log + automated controls dramatically reduce audit preparation time. Production deployments report 5-10x faster audit cycles vs custom-built systems.
Aeion's documentation covers operational procedures. For compliance-specific training (DPO certifications, ICO best practices), partner with specialized providers. Aeion can integrate with LMS / training-tracking systems via the LMS module.