Skip to content

πŸ”’ GDPR external-processor providers β€” Stripe customer + PostHog person (config-gated)Β #3940

Description

@PierreBrisorgueil

Ship the Art 17(2)/19 third-party propagation as ordinary registered providers, config-gated β€” every consumer of the stack gets processor erasure for free.

Scope

  • Stripe β€” billing.init.js additionally registers { key:'stripe-customer', axes:['org'], external:true, erase }: delete the Stripe Customer for sole-owned orgs (customers.del), stopping new activity; Stripe independently retains transaction records under its own legal obligations (documented in the consumer guide + privacy template). Registered only when Stripe is configured.
  • PostHog β€” analytics init registers { key:'posthog-person', axes:['user'], external:true, erase }: call the person-deletion API (delete_events=true) for the user's distinct id. Registered only when analytics is configured.
  • Mail provider β€” no API call shipped; the consumer guide documents reliance on the provider's automatic message-data retention window as the accepted Art 19 answer (must be stated in the privacy policy).
  • external:true semantics (from the registry): fail-open-with-record β€” an API failure is written to the erasure ledger (failed + message) for manual follow-up and NEVER blocks local erasure.

DoD

  • Both providers register only when their integration is configured; no-op otherwise.
  • External API failure β†’ ledger records it, local erasure completes.
  • /verify green.

Depends on: registry leaf v2, ErasureRequest ledger, export+erasure controller.

Created via /dev:issue Β· contract v2 2026-07-03

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions