Audit & privacy for a regulated platform

What this design does

Compliance features bolted on late become spreadsheets and apologies. Built in, they're four mechanisms: every action lands in a hash-chained audit log that provably hasn't been edited; privileged operations need a second human (maker-checker); raw PII lives only in a tokenization vault, encrypted with per-user keys; and 'right to be forgotten' is executed by destroying the user's key — crypto-shredding — which erases them from every backup ever taken, instantly.

The patterns it composes

• Tamper-evident audit log — hash-chained entries — editing history breaks the chain visibly
• Maker-checker — privileged changes require a second approver, enforced in the path
• Tokenization vault — services handle tokens; raw PII exists in exactly one place
• Crypto-shredding — delete the per-user key and every copy of their data goes dark
• Consent as data — processing checks purpose against a consent store, not a PDF

Import it, attach your own numbers, and verify the design against failures — or read the engineering notes.