# Data protection impact assessment: the parts Mirror can pre-fill

A DPIA is the controller's. This page pre-fills the facts about Mirror that a bank's DPO would otherwise have to extract. Each fact is marked as either **enforced in code** (with the test that pins it) or **a design statement**.

**Not legal advice.** Counsel decides the legal characterisation.

## 1. The processing

| Question | Answer |
|---|---|
| Purpose | Detect mispricing and phantom shipments across institutions (trade-based money laundering) by comparing commitments, never the underlying data. |
| Who the controllers are | Each member bank, for its own trade data. Mirror's operator acts on the bank's instructions under the corridor agreement. The allocation of roles is counsel's to settle. |
| What stays inside the bank | Every value, quantity, price band, corridor secret, document, counterparty name and customer identifier. The bander runs inside the bank and has no network (`verify-diode`). |
| What the operator receives | Salted band commitments (hashes), opaque locator commitments, role labels, member-signed attestations, witness measurements (commitments only), and governance events. **Enforced in code:** the raw-data wall refuses value, quantity, band, table, salt, grade, container number and document-salt fields at any depth, on every route (`/cannot`: `raw_value`, `cargo_identifier`, `assay_and_origin_secret`). |
| Staff data at the operator | None. Access is by member and desk **keys** with role labels; names and email addresses are refused (`/cannot`: `staff_directory`). |
| Perpetual-KYC triggers | An entity **commitment** (a salted hash computed inside the bank), a type and a legal basis; never a name or a reason. |

## 2. Is anything the operator holds personal data?

- **Commitments to entity identifiers** (pKYC) are pseudonymised data under GDPR Art. 4(5). They are computed under a secret the operator never holds. Whether they are personal data **in the operator's hands** is a question of means reasonably likely to be used; counsel should decide it. **The conservative position is to treat them as personal data**, and the rest of this page assumes it.
- **Band commitments and locators** describe trades, not people. Where a trade party is a natural person (a sole trader), treat them like the pKYC commitments.
- **Member keys and delegate labels** are institutional, not personal.

## 3. Risks and the controls that answer them

| Risk | Control | Evidence |
|---|---|---|
| The operator re-identifies a party | It never receives an identifier or a value; brute-forcing a commitment needs the corridor secret (≥128 bits, generated) | `/cannot` `raw_value`, `secret_custody`; `mirror-bander check-secret` |
| The operator draws the correspondent graph | Blind join keys; push only to proven parties; counts only above k | `/cannot` `push_to_non_party`, `path_count_below_k`; `server/cutover.test.js` |
| A filing decision leaks (tipping-off) | The filing-decision wall at the door and in the verifier | `/cannot` `filing_decision`, `filing_in_record` |
| Data kept longer than needed | Retention by record class; crypto-shredding by destroying keys | [Retention schedule](/retention-schedule.md) |
| A breach at the operator | What it holds is commitments and signatures; its store is RLS-locked to the service role | [Sub-processors](/subprocessors.md) |
| Access by the wrong desk | Scoped, short-lived, revocable desk keys | [Access control](/access-control.md) |

## 4. International transfers

- **The operator** processes every request in a Cloudflare Durable Object restricted to the EU jurisdiction, and stores state in a Supabase database in AWS eu-central-1 (Frankfurt). The Cloudflare data centre that first receives a request can be outside the EU; it forwards the request unread. The operator signs this at `GET /residency` ([data residency](/data-residency.md)).
- **The transfer analysis** is counsel's. The facts are in [data residency](/data-residency.md) and [sub-processors](/subprocessors.md).

## 5. What the bank still has to write

- Necessity and proportionality for its own AML programme.
- The legal basis for sharing each signal. Mirror requires a recognised basis on a trigger when the operator is configured to (`requireLegalBasis`).
- Its own retention periods.
- The consultation outcome, if one is needed.