# APPI Data Processing and Cross-Border Assessment

## Status and use

This is a customer-specific assessment template for CASAN deployments in Japan.
It records facts needed for an APPI review; it does **not** claim that CASAN or
a customer deployment is APPI-compliant. The customer’s privacy/legal owner
must approve the completed version before production processing begins.

## Processing inventory

| Data category | Typical source | CASAN purpose | Storage / recipient | Default retention | Deployment decision required |
|---|---|---|---|---|---|
| Source code and diffs | Git repository, AI coding tool | policy/test/security evaluation; Evidence Pack | customer workspace and Evidence Pack store | customer policy | whether any code may leave customer network |
| Prompts and chat content | Control Panel / AI tool | governed response, routing, audit | customer runtime; selected model provider only when configured | customer policy | provider, country/region, model and allowed fields |
| Secrets / credentials | source, logs, environment | detection/blocking only | should be masked; must not be placed in Evidence Pack | not retained intentionally | scanner/exception procedure |
| Developer identifiers | IdP claims, audit record | RBAC, accountability, approval trace | customer identity/audit store | customer policy | legitimate purpose, access roles |
| Telemetry and costs | model/provider and runner | FinOps, reliability, anomaly detection | customer telemetry store / selected provider | customer policy | provider API and export destination |
| Evidence Pack metadata | CASAN gates and manifests | auditability and proof | customer Evidence Pack storage; optional Gitea artifact | customer policy | retention, immutable-storage setting, artifact access |

## Required deployment register

For every customer project, complete the following fields and attach it to the
PoC or production change record.

| Field | Value / approval |
|---|---|
| Customer data controller / privacy contact | |
| CASAN operator and support contact | |
| Processing purpose and affected projects | |
| Personal information expected in source, prompts or logs | |
| Model providers, model IDs, processing country/region | |
| Subprocessors and service locations | |
| Cross-border transfer assessment / required information | |
| Retention, deletion and export schedule | |
| Evidence Pack, backup and artifact storage location | |
| Incident notification contacts and target timing | |
| Approved masking / secret-scanning policy | |
| Approval date, reviewer and next review date | |

## CASAN control mapping

- H4 / data-exfil guard scans prompts and artifacts before release. A BLOCK is
  evidence of detection, not evidence that no sensitive data was ever sent.
- H5 audit records accountable actions and policy changes.
- H6 records execution/cost telemetry. It must be included in the retention
  decision because it can identify a user, project, provider or run.
- Evidence Pack stores summaries and hashes; it still needs a retention,
  access-control, backup and deletion decision.
- Cloud-model use is opt-in at deployment time. The customer must document what
  fields are transmitted and select an allowed provider/region.

## Data-subject and operational procedures

The operator must implement customer-approved procedures for access requests,
correction/deletion/export where applicable, retention expiry, secret leak
investigation, incident triage and vendor/subprocessor changes. A Gitea Actions
artifact is not an immutable long-term retention system by itself.

## Evidence required before a production claim

1. Completed register for each tenant/project and model route.
2. Network/data-flow diagram tested against the deployed configuration.
3. Provider and subprocessor review, including cross-border transfer facts.
4. Retention/deletion test for logs, Evidence Packs, backups and CI artifacts.
5. Incident-response tabletop or drill with named contacts.
6. Review by the customer’s Japanese privacy/legal owner.

## Reference

Use the authoritative Japanese APPI text and Personal Information Protection
Commission guidance for the final legal assessment. English translations and
this template are working aids only; they are not the controlling legal text.