docs: add APPI data processing assessment template

2026-07-18 00:21:36 +07:00
parent b921f25c57
commit 8a676f0ad4
3 changed files with 83 additions and 0 deletions
@@ -0,0 +1,73 @@
+# APPI Data Processing and Cross-Border Assessment
+
+## Status and use
+
+This is a customer-specific assessment template for CASAN deployments in Japan.
+It records facts needed for an APPI review; it does **not** claim that CASAN or
+a customer deployment is APPI-compliant. The customer’s privacy/legal owner
+must approve the completed version before production processing begins.
+
+## Processing inventory
+
+| Data category | Typical source | CASAN purpose | Storage / recipient | Default retention | Deployment decision required |
+|---|---|---|---|---|---|
+| Source code and diffs | Git repository, AI coding tool | policy/test/security evaluation; Evidence Pack | customer workspace and Evidence Pack store | customer policy | whether any code may leave customer network |
+| Prompts and chat content | Control Panel / AI tool | governed response, routing, audit | customer runtime; selected model provider only when configured | customer policy | provider, country/region, model and allowed fields |
+| Secrets / credentials | source, logs, environment | detection/blocking only | should be masked; must not be placed in Evidence Pack | not retained intentionally | scanner/exception procedure |
+| Developer identifiers | IdP claims, audit record | RBAC, accountability, approval trace | customer identity/audit store | customer policy | legitimate purpose, access roles |
+| Telemetry and costs | model/provider and runner | FinOps, reliability, anomaly detection | customer telemetry store / selected provider | customer policy | provider API and export destination |
+| Evidence Pack metadata | CASAN gates and manifests | auditability and proof | customer Evidence Pack storage; optional Gitea artifact | customer policy | retention, immutable-storage setting, artifact access |
+
+## Required deployment register
+
+For every customer project, complete the following fields and attach it to the
+PoC or production change record.
+
+| Field | Value / approval |
+|---|---|
+| Customer data controller / privacy contact | |
+| CASAN operator and support contact | |
+| Processing purpose and affected projects | |
+| Personal information expected in source, prompts or logs | |
+| Model providers, model IDs, processing country/region | |
+| Subprocessors and service locations | |
+| Cross-border transfer assessment / required information | |
+| Retention, deletion and export schedule | |
+| Evidence Pack, backup and artifact storage location | |
+| Incident notification contacts and target timing | |
+| Approved masking / secret-scanning policy | |
+| Approval date, reviewer and next review date | |
+
+## CASAN control mapping
+
+- H4 / data-exfil guard scans prompts and artifacts before release. A BLOCK is
+  evidence of detection, not evidence that no sensitive data was ever sent.
+- H5 audit records accountable actions and policy changes.
+- H6 records execution/cost telemetry. It must be included in the retention
+  decision because it can identify a user, project, provider or run.
+- Evidence Pack stores summaries and hashes; it still needs a retention,
+  access-control, backup and deletion decision.
+- Cloud-model use is opt-in at deployment time. The customer must document what
+  fields are transmitted and select an allowed provider/region.
+
+## Data-subject and operational procedures
+
+The operator must implement customer-approved procedures for access requests,
+correction/deletion/export where applicable, retention expiry, secret leak
+investigation, incident triage and vendor/subprocessor changes. A Gitea Actions
+artifact is not an immutable long-term retention system by itself.
+
+## Evidence required before a production claim
+
+1. Completed register for each tenant/project and model route.
+2. Network/data-flow diagram tested against the deployed configuration.
+3. Provider and subprocessor review, including cross-border transfer facts.
+4. Retention/deletion test for logs, Evidence Packs, backups and CI artifacts.
+5. Incident-response tabletop or drill with named contacts.
+6. Review by the customer’s Japanese privacy/legal owner.
+
+## Reference
+
+Use the authoritative Japanese APPI text and Personal Information Protection
+Commission guidance for the final legal assessment. English translations and
+this template are working aids only; they are not the controlling legal text.