Skip to main content
SynaptaGrid Platform
← All capabilities
Available now

Platform capability · GDPR & Data Lifecycle

Each app declares its personal data and how to export and erase it

Shared GDPR rules for every app on the platform

Each app declares how it handles GDPR export, erasure and consent. Publishing rejects an app that has personal-data fields and no handlers for them. Erasure across apps runs as a background operation that can resume: the platform finds the installed apps from their current declarations, calls each app’s erasure handler and tracks the result.

Built in

What you get

  • Each app declares its endpoints for export, erasure and consent
  • An app declaration with personal-data fields and no GDPR section is rejected
  • Soft delete on every record type, with restore and a recycle bin
  • Audit events name people by ID. Erasure deletes the events about the person and adds an erasure record
  • Personal data is removed from logs by default
  • Sign-in tokens carry the minimum of personal data. Profile data is read from the OIDC user-info endpoint
  • Cookie banner with equal Accept and Decline buttons. Each choice is logged in the visitor’s region, with no IP address
  • A consent log for each account: terms, privacy, marketing and analytics, with version, source and time
  • Privacy choices in the portal, where consent is as easy to withdraw as it was to give
  • The consent log is included in the personal data export
  • Erasure runs across every installed app, with completion tracked for each app and failed steps retried
Under the hood

How it works

GDPR controls are part of the platform

A platform that promises GDPR compliance but keeps email addresses in its audit logs, or never deletes old notification logs, fails its first audit. SynaptaGrid builds the controls into rules that every app shares. Apps declare their erasure and export endpoints, the platform coordinates erasure across apps, shared record types use soft delete and logging rules remove sensitive fields.

Erasure is tracked across every installed app

When a user is erased, the platform starts a background operation and reads the erasure endpoint that each installed app declares. Each app deletes or anonymizes its own data, either at once or as a background task. A status record for each app makes a partial failure visible and lets the operation resume, so personal data is not left behind unnoticed.

Retention periods are declared with the data

Each class of data has a retention period in days. A scheduled job permanently removes soft-deleted records once that period has passed. Audit retention is one value for each organization that operators can change (7 years by default), with an optional long-term archive and a grace period after archiving before permanent deletion. Customers know how long data is kept, and auditors can verify it.

Further additions

Additions that extend the capability described above.

  • One endpoint that exports a person’s data from every app
Pairs well with

Related capabilities

Audit

An audit trail that can only be added to, where tampering shows

Sign-in & Identity

Every sign-in screen carries your brand

Organizations, Plans & Settings

One record of every customer, app, plan and setting, with overrides for each customer

Data Residency

Regional placement of customer data, including the EU

Want a deeper walkthrough of GDPR & Data Lifecycle?

A solution architect will demo the live service against your domain model.

Get a deployment assessment