> ## Documentation Index
> Fetch the complete documentation index at: https://docs.veristar.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Records of processing

> The records of processing activities for the service.

> **Status: draft, pending legal review (input I10).** Not legal advice. Last
> updated 2026-11-12. Two records: the operator as processor for tenants
> (GDPR Art. 30(2)) and the operator as controller of console accounts (Art.
> 30(1)). The operator's name and contact are filled in when the operating
> entity is decided (open question for SCF, plan section 27); until then this
> record names the role, not the entity.

## A. Processing on behalf of tenants (operator as processor)

| Item | Entry |
| - | - |
| Processor | the service operator (SCF until handover, then the community operator) |
| Controllers | each enrolled tenant, as listed in `cp.tenants` |
| Categories of processing | collection of web page views and custom events through the tracker; country lookup; daily visitor token computation; queueing; storage and reporting in Umami; daily aggregates for the operator view; collection of HTTP server metrics and spans from tenant applications, reduction to request counts and latency histograms, storage and reporting; erasure on request |
| Categories of data subjects | visitors of tenant websites; clients of tenant APIs (only as anonymous request counts and latencies) |
| Categories of personal data | for web visitors, held in memory only: IP address and user agent. Stored: daily visitor token as part of Umami's session id, browser, operating system, device type, screen size, language, country, page path with allowlisted query, referrer scheme and host, page title, event names and event data. For API clients: none at the level of a person; only tenant, service, normalized route, method, status and latency buckets |
| Recipients | the tenant's members (its own dashboards); SCF operators (aggregates only, see `privacy-strategy.md` section 1); sub-processors in `subprocessors.md` |
| Transfers to third countries | none for analytics data (`data-residency.md`) |
| Retention | `privacy-strategy.md` section 4 |
| Security measures | `dpia.md` section 5 |

## B. Console accounts (operator as controller)

| Item | Entry |
| - | - |
| Controller | the service operator |
| Purpose | sign-in to the console, membership of projects, audit of changes |
| Data subjects | tenant staff and operators who sign in |
| Personal data | numeric GitHub user id, GitHub login, project memberships and roles, session token hashes, audit log entries naming the user id |
| Legal basis | to be decided by counsel (performance of the service terms is the working assumption) |
| Recipients | GitHub, Inc. for the sign-in itself (`subprocessors.md`) |
| Transfers | the sign-in passes through GitHub in the United States |
| Retention | sessions: 7 days absolute, 24 hours idle; accounts and the audit log: while the service runs (deletion of a console account on request is not implemented as a self-service route yet) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.