{
  "docVersion": 1,
  "id": "template-regulated-audit-privacy",
  "name": "Audit & privacy architecture",
  "purpose": "Regulated-platform privacy spine: hash-chained audit log, maker-checker approvals, tokenized PII with per-user keys, erasure via crypto-shredding.",
  "nodes": {
    "svc": {
      "type": "server",
      "label": "Business Services",
      "x": 20,
      "y": 260,
      "runtime": "the whole app tier",
      "patterns": [
        "stateless"
      ]
    },
    "consent": {
      "type": "database",
      "label": "Consent Store",
      "x": 300,
      "y": 90,
      "runtime": "purpose × user grants",
      "notes": "Every processing path checks purpose here first. Consent is queryable data, not a legal document."
    },
    "approve": {
      "type": "worker",
      "label": "Maker-Checker",
      "x": 300,
      "y": 430,
      "runtime": "four-eyes approvals",
      "color": "amber",
      "notes": "Limit changes, exports, role grants — the maker proposes, a different human approves, both land in the audit log."
    },
    "vault": {
      "type": "vault",
      "label": "Token Vault",
      "x": 580,
      "y": 260,
      "runtime": "PII ⇄ token",
      "color": "purple",
      "patterns": [
        "replicated"
      ],
      "notes": "The only component that ever sees raw PII. Everything else stores and passes opaque tokens."
    },
    "kms": {
      "type": "kms",
      "label": "Per-User Keys",
      "x": 860,
      "y": 260,
      "runtime": "one key per user",
      "notes": "Envelope encryption: user data encrypts under the user's own key. Destroying it IS erasure — even in old backups."
    },
    "appdb": {
      "type": "database",
      "label": "App Data",
      "x": 580,
      "y": 90,
      "runtime": "tokens only — no raw PII",
      "patterns": [
        "backup"
      ]
    },
    "audit": {
      "type": "audit",
      "label": "Audit Log",
      "x": 580,
      "y": 500,
      "runtime": "hash-chained · append-only",
      "color": "green",
      "patterns": [
        "replicated",
        "backup"
      ],
      "notes": "entry[n] includes hash(entry[n-1]) — auditors verify the chain, not our word."
    },
    "erase": {
      "type": "worker",
      "label": "Erasure Service",
      "x": 1140,
      "y": 260,
      "runtime": "GDPR art. 17 executor",
      "color": "red"
    },
    "dpo": {
      "type": "user",
      "label": "Auditor / DPO",
      "x": 860,
      "y": 500,
      "runtime": "verifies the chain"
    }
  },
  "edges": {
    "e1": {
      "from": "svc",
      "to": "consent",
      "fromSide": "right",
      "toSide": "left",
      "label": "purpose allowed?",
      "patterns": [
        "cache-aside"
      ]
    },
    "e2": {
      "from": "svc",
      "to": "vault",
      "fromSide": "right",
      "toSide": "left",
      "label": "tokenize PII",
      "animated": true,
      "patterns": [
        "encrypted",
        "authenticated"
      ]
    },
    "e3": {
      "from": "vault",
      "to": "kms",
      "fromSide": "right",
      "toSide": "left",
      "label": "encrypt under user key",
      "patterns": [
        "encrypted"
      ]
    },
    "e4": {
      "from": "svc",
      "to": "appdb",
      "fromSide": "right",
      "toSide": "left",
      "label": "store tokens"
    },
    "e5": {
      "from": "svc",
      "to": "approve",
      "fromSide": "right",
      "toSide": "left",
      "label": "privileged op → 2nd human",
      "style": "dashed"
    },
    "e6": {
      "from": "approve",
      "to": "audit",
      "fromSide": "right",
      "toSide": "left",
      "label": "proposal + approval",
      "style": "dashed"
    },
    "e7": {
      "from": "svc",
      "to": "audit",
      "fromSide": "bottom",
      "toSide": "left",
      "label": "every action, hash-chained",
      "animated": true
    },
    "e8": {
      "from": "erase",
      "to": "kms",
      "fromSide": "left",
      "toSide": "right",
      "label": "destroy key = crypto-shred",
      "style": "dashed"
    },
    "e9": {
      "from": "dpo",
      "to": "audit",
      "fromSide": "left",
      "toSide": "right",
      "label": "verify chain integrity"
    }
  },
  "boxes": {
    "b1": {
      "x": 540,
      "y": 190,
      "w": 600,
      "h": 240,
      "label": "pii boundary — raw data never leaves",
      "color": "purple",
      "opacity": 0.04
    }
  },
  "texts": {
    "t1": {
      "x": 20,
      "y": 470,
      "text": "crypto-shredding: backups are immutable, so you can't\ndelete a user from last month's tape. But if their data\nonly ever existed under their key — burn the key and\nevery copy everywhere becomes noise.",
      "color": "purple",
      "size": 12
    }
  },
  "meta": {
    "createdAt": "2026-07-13T09:00:00.000Z",
    "modifiedAt": "2026-07-13T09:00:00.000Z"
  }
}