A DPIA is the controller's. This page pre-fills the facts about Mirror that a bank's DPO would otherwise have to extract. Each fact is marked as either enforced in code (with the test that pins it) or a design statement.
Not legal advice. Counsel decides the legal characterisation.
1. The processing#
| Question | Answer |
|---|---|
| Purpose | Detect mispricing and phantom shipments across institutions (trade-based money laundering) by comparing commitments, never the underlying data. |
| Who the controllers are | Each member bank, for its own trade data. Mirror's operator acts on the bank's instructions under the corridor agreement. The allocation of roles is counsel's to settle. |
| What stays inside the bank | Every value, quantity, price band, corridor secret, document, counterparty name and customer identifier. The bander runs inside the bank and has no network (verify-diode). |
| What the operator receives | Salted band commitments (hashes), opaque locator commitments, role labels, member-signed attestations, witness measurements (commitments only), and governance events. Enforced in code: the raw-data wall refuses value, quantity, band, table, salt, grade, container number and document-salt fields at any depth, on every route (/cannot: raw_value, cargo_identifier, assay_and_origin_secret). |
| Staff data at the operator | None. Access is by member and desk keys with role labels; names and email addresses are refused (/cannot: staff_directory). |
| Perpetual-KYC triggers | An entity commitment (a salted hash computed inside the bank), a type and a legal basis; never a name or a reason. |
2. Is anything the operator holds personal data?#
- Commitments to entity identifiers (pKYC) are pseudonymised data under GDPR Art. 4(5). They are computed under a secret the operator never holds. Whether they are personal data in the operator's hands is a question of means reasonably likely to be used; counsel should decide it. The conservative position is to treat them as personal data, and the rest of this page assumes it.
- Band commitments and locators describe trades, not people. Where a trade party is a natural person (a sole trader), treat them like the pKYC commitments.
- Member keys and delegate labels are institutional, not personal.
3. Risks and the controls that answer them#
| Risk | Control | Evidence |
|---|---|---|
| The operator re-identifies a party | It never receives an identifier or a value; brute-forcing a commitment needs the corridor secret (≥128 bits, generated) | /cannot raw_value, secret_custody; mirror-bander check-secret |
| The operator draws the correspondent graph | Blind join keys; push only to proven parties; counts only above k | /cannot push_to_non_party, path_count_below_k; server/cutover.test.js |
| A filing decision leaks (tipping-off) | The filing-decision wall at the door and in the verifier | /cannot filing_decision, filing_in_record |
| Data kept longer than needed | Retention by record class; crypto-shredding by destroying keys | Retention schedule |
| A breach at the operator | What it holds is commitments and signatures; its store is RLS-locked to the service role | Sub-processors |
| Access by the wrong desk | Scoped, short-lived, revocable desk keys | Access control |
4. International transfers#
- The operator processes every request in a Cloudflare Durable Object restricted to the EU jurisdiction, and stores state in a Supabase database in AWS eu-central-1 (Frankfurt). The Cloudflare data centre that first receives a request can be outside the EU; it forwards the request unread. The operator signs this at
GET /residency(data residency). - The transfer analysis is counsel's. The facts are in data residency and sub-processors.
5. What the bank still has to write#
- Necessity and proportionality for its own AML programme.
- The legal basis for sharing each signal. Mirror requires a recognised basis on a trigger when the operator is configured to (
requireLegalBasis). - Its own retention periods.
- The consultation outcome, if one is needed.