CASAN/docs/compliance/APPI_DATA_PROCESSING.md

APPI Data Processing and Cross-Border Assessment

Status and use

This is a customer-specific assessment template for CASAN deployments in Japan. It records facts needed for an APPI review; it does not claim that CASAN or a customer deployment is APPI-compliant. The customer’s privacy/legal owner must approve the completed version before production processing begins.

Processing inventory

Data category	Typical source	CASAN purpose	Storage / recipient	Default retention	Deployment decision required
Source code and diffs	Git repository, AI coding tool	policy/test/security evaluation; Evidence Pack	customer workspace and Evidence Pack store	customer policy	whether any code may leave customer network
Prompts and chat content	Control Panel / AI tool	governed response, routing, audit	customer runtime; selected model provider only when configured	customer policy	provider, country/region, model and allowed fields
Secrets / credentials	source, logs, environment	detection/blocking only	should be masked; must not be placed in Evidence Pack	not retained intentionally	scanner/exception procedure
Developer identifiers	IdP claims, audit record	RBAC, accountability, approval trace	customer identity/audit store	customer policy	legitimate purpose, access roles
Telemetry and costs	model/provider and runner	FinOps, reliability, anomaly detection	customer telemetry store / selected provider	customer policy	provider API and export destination
Evidence Pack metadata	CASAN gates and manifests	auditability and proof	customer Evidence Pack storage; optional Gitea artifact	customer policy	retention, immutable-storage setting, artifact access

Required deployment register

For every customer project, complete the following fields and attach it to the PoC or production change record.

Field	Value / approval
Customer data controller / privacy contact
CASAN operator and support contact
Processing purpose and affected projects
Personal information expected in source, prompts or logs
Model providers, model IDs, processing country/region
Subprocessors and service locations
Cross-border transfer assessment / required information
Retention, deletion and export schedule
Evidence Pack, backup and artifact storage location
Incident notification contacts and target timing
Approved masking / secret-scanning policy
Approval date, reviewer and next review date

CASAN control mapping

• H4 / data-exfil guard scans prompts and artifacts before release. A BLOCK is evidence of detection, not evidence that no sensitive data was ever sent.
• H5 audit records accountable actions and policy changes.
• H6 records execution/cost telemetry. It must be included in the retention decision because it can identify a user, project, provider or run.
• Evidence Pack stores summaries and hashes; it still needs a retention, access-control, backup and deletion decision.
• Cloud-model use is opt-in at deployment time. The customer must document what fields are transmitted and select an allowed provider/region.

Data-subject and operational procedures

The operator must implement customer-approved procedures for access requests, correction/deletion/export where applicable, retention expiry, secret leak investigation, incident triage and vendor/subprocessor changes. A Gitea Actions artifact is not an immutable long-term retention system by itself.

Evidence required before a production claim

1. Completed register for each tenant/project and model route.
2. Network/data-flow diagram tested against the deployed configuration.
3. Provider and subprocessor review, including cross-border transfer facts.
4. Retention/deletion test for logs, Evidence Packs, backups and CI artifacts.
5. Incident-response tabletop or drill with named contacts.
6. Review by the customer’s Japanese privacy/legal owner.

Reference

Use the authoritative Japanese APPI text and Personal Information Protection Commission guidance for the final legal assessment. English translations and this template are working aids only; they are not the controlling legal text.