Skip to main content

Hephaestus — Record of Processing Activities (Art. 30 GDPR)

This page is a template for the Art. 30 record of a Hephaestus deployment. Each section maps to one Art. 30 element. Replace each placeholder with the facts of your deployment, and keep the record in your own governance system.

The pointers name the pages that describe what Hephaestus itself does. Code verifies product behavior, not signed agreements, live settings or operational measures.

Controller and contact (Art. 30(1)(a))​

[controller name, address, representative, privacy contact, DPO where applicable]. Name any joint controllers and their actual arrangement. An admin role alone does not establish Art. 26 status.

Purpose and description (Art. 30(1)(b))​

[each purpose, for each group of data subjects]. Describe the enabled features: practice review of connected repositories, conversations, the weekly digest, Activity, public activity pages, and research use, where you enable them. Practice review, Public activity pages and Legal pages describe what each feature processes.

Data subjects (Art. 30(1)(c))​

[groups]. Include the people whose work Hephaestus mirrors without a sign-in, and Slack participants where you connect Slack.

Categories of personal data​

[categories]. The personal-data map lists each store and what it holds.

Recipients (Art. 30(1)(d))​

[each recipient, its role, and the agreement]. The processor checklist lists the recipients to assess and the evidence to record.

Third-country transfers (Art. 30(1)(e))​

[each transfer, its destination and its Chapter V safeguard].

Storage location and retention (Art. 30(1)(f))​

[storage locations, and the period or deletion trigger of each category]. Data retention lists the periods that Hephaestus applies and the settings that change them. The personal-data map describes erasure and residual copies.

Technical and organizational measures (Art. 30(1)(g) and Art. 32)​

[access owners, key management, backups and their expiry, restore tests, incident response]. The threat model, Secret custody and Backup and restore describe the measures that Hephaestus supplies.

[the basis and its necessity, for each purpose and group]. Terms acceptance and the AI choice do not supply a legal basis.

Information duty (Arts. 13 and 14)​

[how and when each group receives the notice]. Legal pages describes how to publish the notice.