product / governance
Governance
Preventing a disclosure is half the job. The other half is being able to show, a year later, exactly what left the building and what was done to it first.
Policy as versioned config
Policies are text files under your own version control, promoted through environments like any other config. Every request records the policy version that governed it, so an audit question about March gets answered with March’s rules rather than today’s.
Append-only transformation log
One record per transformation: detector, confidence, transform applied, token issued, policy version, destination, timestamp. Records are hash-chained, so a gap or an edit is detectable. Original values are never written to the log.
Data-flow maps
Which classes of sensitive data reached which vendor, over which period, under which policy. This is the artefact that turns a records-of-processing obligation from an interview exercise into a query.
Evidence export
Scoped, signed exports for an auditor or a regulator, covering a date range and a system, without handing over a console login.
Alerting on drift
A new field appearing in an outbound payload, a spike in low-confidence spans, or a destination nobody registered — routed to your SIEM rather than to a dashboard nobody opens.
What a record looks like
Enough to reconstruct the decision, never enough to reconstruct the data. The log holds the token and a keyed hash of the original — not the original — so the audit trail is not itself a second copy of everything you were protecting.
Retention window and export formats [CONFIRM]
{
"ts": "2026-03-14T09:22:41.118Z",
"policy": "support-tickets@v4",
"destination": "api.openai.com",
"detector": "pci.pan",
"confidence": 1.0,
"transform": "redact",
"token": "[REDACTED]",
"value_hmac": "9c1f…a30b", // not the value
"prev": "4e77…12dd" // hash chain
}