Data protection architecture.
Tenancy, residency, and retention.
The verifiable lifecycle of feedback records across collection, enrichment, storage, and automated retention deletion. Documented for institutional compliance officers and Data Protection Officers under GDPR, CCPA, and statutory privacy mandates.
You
Are the data controller
We process strictly on your documented instructions, formalized in the DPA.
72h
Breach notification
Documented contractual commitment covering incident disclosure.
Any time
Full corpus export
Open formats including JSON Lines and Apache Parquet with zero lock-in.
Job-enforced
Retention schedules
Automated cron workers purge expired records at the database layer.
Defined controller and processor boundaries under data protection law.
Your institution acts as the sole data controller, defining the lawful basis, collection purpose, and downstream disposition of feedback records. Yves operates strictly as a data processor under documented contractual instructions, formalized in our Data Processing Addendum.
During onboarding, taxonomy design is audited against your stated purpose to ensure feedback categories do not elicit unnecessary personal or special category data.
All privacy notices and respondent terms are reviewed and approved by your legal counsel prior to production launch.
Choosing your jurisdiction rather than inheriting one
Where the corpus lives determines which law reaches it, so residency is a deployment decision rather than a setting. International transfers are documented in the sub-processor list with the region for each one, and covered by the standard contractual clauses in the agreement.
- Shared backend: managed database in the EU, with hosting at the edge and the origin in the deployment region
- Isolated and above: you choose the region for the corpus
- Dedicated: your own infrastructure and your own contracted model keys, with on-premises available by arrangement
- Language model provider sits in the United States by default, relocatable on Dedicated or replaced entirely
- Thirty days' written notice before any sub-processor is added, with a right to object and terminate
Proactive prevention and automated isolation of sensitive personal data
Unstructured free-text fields can receive medical disclosures, union affiliations, or legal allegations. Yves deploys client-side guidance and automated server-side redaction to prevent sensitive personal data from entering operational reporting.
- The intake advisory prompts respondents to avoid submitting identifying clinical or personal tokens
- Placeholder text directs feedback toward process, facility, and operational touchpoints
- Client-side message coaching advises respondents against naming specific individuals
- The enrichment pipeline flags detected PII and excludes it from dashboard summaries and indexing
- Where mandated by local regulations, comprehensive Data Protection Impact Assessments (DPIAs) accompany deployment
Exercising access and erasure rights under zero-knowledge intake
Data protection frameworks grant individuals rights of access, rectification, and erasure. Because Yves stores zero IP addresses or user account linkages for anonymous submissions, satisfying these requests follows established procedures under GDPR Article 11.
- Console operators and staff accounts: named identities with standard access, rectification, and erasure processed within one business day
- Anonymous message submitters: no identifying database keys exist to correlate submissions to an individual identity
- If a submitter provides verified unique message details to identify their submission, the controller can execute an authorized deletion
- GDPR Article 11 formally governs processing that does not require submitter re-identification, and this posture is recorded in the DPA
- Formal data protection inquiries reach privacy@yves.africa and receive written responses within one business day
What happens to a message, in order
01
Collection
A plain form post over an encrypted connection. No network address is written, no tracker is set, and every asset including the typeface is served from your own domain. The sender is told in their own language what is kept and what is not, before they submit.
02
Enrichment
Message body text alone reaches the language model provider, for translation, classification against your taxonomy, urgency scoring, personal-data flagging and embeddings. The contract excludes your data from model training. Account data, fingerprints and console activity never leave the platform.
03
Storage
Encrypted in transit and at rest, inside a tenant isolated at the data layer rather than by application code, with the tenant filter applied again in every query. Point-in-time recovery runs on the primary database.
04
Access
A four-role model with per-role redaction. Reaching personal data requires a declared purpose and expires on its own. Every grant, every denial and every off-hours access is written to an immutable audit trail at the data layer.
05
Retention and deletion
Your retention window is configurable and enforced by a scheduled job, so removal happens whether or not anyone remembers. Quarantined content is held, never silently deleted, and every removal is gated, typed-confirmed and signed in the log.
06
Exit
Full corpus export in open formats at any time, including on the day you leave. Deletion on termination is fixed in the agreement, with written confirmation once it has run.
Asked often enough to answer here
Request our DPIA and
security compliance pack.
Comprehensive Data Protection Impact Assessments, subprocessor directories, and completed CAIQ security questionnaires available for compliance review.