Verified processing facts
The implementation has a documented technical data map. It is not a substitute for a final privacy notice because controller identity, jurisdiction, hosting region, retention, subprocessor contracts, legal bases, transfer mechanism, and data-rights process have not been supplied.
- 01
When enabled, workspace identity stores name, email address, scrypt password derivative, session/token hashes, role, tenant ID, and privacy-hashed network/browser data in PostgreSQL.
- 02
Verification, recovery, and recipient-proof messages are delivered through email service when configured. One-time codes are not placed in URLs.
- 03
Founding-partner intake is disabled in the observed hosted deployment. When enabled after production preflight, it stores name, company, selected workflow bands, privacy hashes, and an AES-GCM-encrypted contact email.
- 04
Evidence delivery may process approved report evidence, provenance, recipient metadata, and access outcomes inside the selected self-hosted or configured private processing boundary.
- 05
edge-infrastructure provider challenge service receives a verification token and request IP only when its production anti-automation configuration is enabled.
What must be decided before publication
- 01
Legal entity, trading name, registration number, registered address, and contact details.
- 02
Countries targeted, governing law, venue, B2B/consumer scope, and applicable consumer-rights treatment.
- 03
Commercial plan, currency, billing cadence, payment processor, taxes, cancellation timing, and refund authority.
- 04
Support hours, maintenance process, incident response, uptime measurement, credits, limitations, and exclusions.
- 05
Hosting region, subprocessor list, retention/deletion schedule, data-use decisions, and data-subject request process.
Current public-service boundary
The observed public hosted deployment is deliberately fail-closed for workspace identity, email, CAPTCHA, durable audit, private authoring, and prospect intake. RipoDoc must not say these processing operations are live until the production preflight passes.