GDPR Compliance
Architecture.
A structural breakdown of how our zero-trust memory pipelines and automated 30-day data minimization protocols align perfectly with EU privacy mandates.
Authepy as a Data Processor
Authepy processes end-user verification data on behalf of its customers, who determine the purposes and means of processing. Our infrastructure is designed around data minimization, controlled retention, security and documented processing practices.
Article 5: Minimization
EnforcedEnd-user verification tokens are processed within transient application memory and are not intentionally stored as persistent plaintext verification data. Operational routing metadata is subject to the applicable retention policy and automated deletion processes.
Articles 15-21: Subject Rights
EnforcedAuthepy's data-minimization architecture reduces the amount of end-user verification data requiring retention. Verification data is not maintained as a persistent user profile, while applicable operational metadata is subject to defined retention and deletion controls. Requests involving customer-controlled data remain the responsibility of the applicable Data Controller.
Article 32: Security Processing
EnforcedInternal workspace data and Developer API Keys are protected at rest using AES-256 envelope encryption. Inbound connections require TLS 1.3. These controls form part of Authepy's technical and organizational measures for protecting data processed through the service.
Chapter V: Border Transfers
EnforcedWhere personal data is processed through infrastructure or subprocessors located outside the EEA, applicable transfer mechanisms are used as documented in Authepy's Data Processing Agreement, including Standard Contractual Clauses where applicable.