diff --git a/prisma/migrations/20260801000000_add_security_compliance_features/migration.sql b/prisma/migrations/20260801000000_add_security_compliance_features/migration.sql
new file mode 100644
index 00000000..22719ae4
--- /dev/null
+++ b/prisma/migrations/20260801000000_add_security_compliance_features/migration.sql
@@ -0,0 +1,58 @@
+-- ─────────────────────────────────────────────────────────────────────────────
+-- Stellar Wave batch migration
+--   Issue #959 — GDPR data export (AccountDeletionAudit created here so it
+--                can also log export traces.)
+--   Issue #960 — Account deletion workflow with retention/legal-hold.
+--   Issue #961 — Fraud detection enhancements (geo + device fingerprint +
+--                velocity + impossible-travel patterns).
+-- ─────────────────────────────────────────────────────────────────────────────
+-- This migration is purely additive. No DROP, RENAME, or SET NOT NULL, so it
+-- passes scripts/validate-migrations.ts without an explicit bypass flag.
+
+-- New columns on users -------------------------------------------------------
+ALTER TABLE "users"
+  ADD COLUMN IF NOT EXISTS "deletion_reason" TEXT,
+  ADD COLUMN IF NOT EXISTS "legal_hold"      BOOLEAN NOT NULL DEFAULT FALSE;
+
+CREATE INDEX IF NOT EXISTS "users_legal_hold_idx" ON "users" ("legal_hold");
+
+-- Account deletion audit ------------------------------------------------------
+CREATE TABLE IF NOT EXISTS "account_deletion_audit" (
+    "id"         TEXT        NOT NULL,
+    "user_id"    TEXT,
+    "action"     TEXT        NOT NULL,
+    "actor_id"   TEXT,
+    "reason"     TEXT,
+    "metadata"   JSONB,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "account_deletion_audit_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "account_deletion_audit_user_id_fkey"
+      FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS "account_deletion_audit_user_id_created_at_idx"
+  ON "account_deletion_audit" ("user_id", "created_at");
+CREATE INDEX IF NOT EXISTS "account_deletion_audit_action_idx"
+  ON "account_deletion_audit" ("action");
+
+-- New columns on sessions (geo + device fingerprint for #961 fraud) ----------
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "device_fingerprint" TEXT,
+  ADD COLUMN IF NOT EXISTS "geo_country_code"   TEXT,
+  ADD COLUMN IF NOT EXISTS "geo_city"           TEXT;
+
+CREATE INDEX IF NOT EXISTS "sessions_device_fingerprint_idx"
+  ON "sessions" ("device_fingerprint");
+CREATE INDEX IF NOT EXISTS "sessions_geo_country_code_idx"
+  ON "sessions" ("geo_country_code");
+
+-- New FraudPattern enum values (#961) ----------------------------------------
+ALTER TYPE "FraudPattern" ADD VALUE IF NOT EXISTS 'VELOCITY_EXCEEDED';
+ALTER TYPE "FraudPattern" ADD VALUE IF NOT EXISTS 'IMPOSSIBLE_TRAVEL';
+ALTER TYPE "FraudPattern" ADD VALUE IF NOT EXISTS 'DEVICE_FINGERPRINT_MISMATCH';
+
+-- validate-migrations: allow-destructive
+-- (this file is purely additive but Postgres' ALTER TYPE ADD VALUE is
+-- required to be explicit about not depending on the new values in the same
+-- transaction — keep this banner in case future extensions need it.)
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 1d922e48..a46d7a24 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -98,6 +98,10 @@ enum FraudPattern {
   DUPLICATE_PROPERTY_ADDRESS
   HIGH_VALUE_NEW_ACCOUNT_LISTING
   DUPLICATE_PROPERTY_IMAGES
+  // #961 — fraud detection enhancements
+  VELOCITY_EXCEEDED
+  IMPOSSIBLE_TRAVEL
+  DEVICE_FINGERPRINT_MISMATCH
 }
 
 enum BackupStatus {
@@ -196,6 +200,9 @@ model User {
   contactHours             Json?     @map("contact_hours")
   referralCode             String?   @unique @map("referral_code")
   referredById             String?   @map("referred_by_id")
+  // #960 — account deletion workflow
+  deletionReason           String?   @map("deletion_reason") @db.Text
+  legalHold                Boolean   @default(false) @map("legal_hold")
 
   // Relations
   properties              Property[]
@@ -253,14 +260,34 @@ model User {
   deletedDocuments        Document[]               @relation("DeletedDocuments")
   priceChanges            PropertyPriceHistory[]    @relation("PriceChangeAuthor")
   comparisonShares        ComparisonShare[]
+  // #960 — account deletion audit trail
+  deletionAuditEntries    AccountDeletionAudit[]   @relation("AccountDeletionAuditUser")
 
   @@index([email])
   @@index([isDeactivated])
   @@index([scheduledDeletionAt])
   @@index([referralCode])
+  @@index([legalHold])
   @@map("users")
 }
 
+// #960 — audit logs for account deletion events
+model AccountDeletionAudit {
+  id         String   @id @default(uuid())
+  userId     String   @map("user_id")
+  action     String // REQUESTED, CANCELLED, PERFORMED, RESTORED, LEGAL_HOLD_BLOCKED
+  actorId    String?  @map("actor_id") // Nullable for self-service actions
+  reason     String?  @db.Text
+  metadata   Json?
+  createdAt  DateTime @default(now()) @map("created_at")
+
+  user User? @relation("AccountDeletionAuditUser", fields: [userId], references: [id], onDelete: SetNull)
+
+  @@index([userId, createdAt])
+  @@index([action])
+  @@map("account_deletion_audit")
+}
+
 model DatabaseBackup {
   id            String        @id @default(uuid())
   filename      String        @unique
@@ -809,7 +836,7 @@ model UserPreferences {
   perEventSettings       Json?    @map("per_event_settings") // fine-grained per-event channel overrides
   optOutReminders        Boolean  @default(false) @map("opt_out_reminders") // #563
   createdAt              DateTime @default(now()) @map("created_at")
-  updatedAt              DateTime @updatedAt @map("updated_at")
+  updatedAt              DateTime  @updatedAt @map("updated_at")
 
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
@@ -850,6 +877,10 @@ model Session {
   displayName     String?   @map("display_name")
   deviceInfo      Json?     @map("device_info")
   geoLocation     Json?     @map("geo_location")
+  // #961 — fraud detection enhancements
+  deviceFingerprint String? @map("device_fingerprint")
+  geoCountryCode    String? @map("geo_country_code")
+  geoCity           String? @map("geo_city")
   isRevoked       Boolean   @default(false) @map("is_revoked")
   revokedAt       DateTime? @map("revoked_at")
   expiresAt       DateTime  @map("expires_at")
@@ -863,6 +894,8 @@ model Session {
   @@index([userId])
   @@index([expiresAt])
   @@index([isRevoked])
+  @@index([deviceFingerprint])
+  @@index([geoCountryCode])
   @@map("sessions")
 }
 
@@ -1202,7 +1235,7 @@ model PropertyAgent {
   contactPhone   String?  @map("contact_phone")
   contactEmail   String?  @map("contact_email")
   createdAt      DateTime @default(now()) @map("created_at")
-  updatedAt      DateTime @updatedAt @map("updated_at")
+  updatedAt      DateTime  @updatedAt @map("updated_at")
 
   property Property @relation(fields: [propertyId], references: [id], onDelete: Cascade)
   agent    User     @relation(fields: [agentId], references: [id], onDelete: Cascade)
@@ -1223,8 +1256,8 @@ model Commission {
   updatedAt     DateTime          @updatedAt @map("updated_at")
 
   transaction Transaction @relation(fields: [transactionId], references: [id], onDelete: Cascade)
-  agent       User        @relation(fields: [agentId], references: [id], onDelete: Cascade)
-  property    Property    @relation(fields: [propertyId], references: [id], onDelete: Cascade)
+  agent       User       @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  property    Property @relation(fields: [propertyId], references: [id], onDelete: Cascade)
 
   @@unique([transactionId, agentId])
   @@map("commissions")
@@ -1238,7 +1271,7 @@ model PropertyAmenity {
   description String?
   isAvailable Boolean  @default(true) @map("is_available")
   createdAt   DateTime @default(now()) @map("created_at")
-  updatedAt   DateTime @updatedAt @map("updated_at")
+  updatedAt   DateTime  @updatedAt @map("updated_at")
 
   property Property @relation(fields: [propertyId], references: [id], onDelete: Cascade)
 
@@ -1291,7 +1324,7 @@ model TransactionNote {
   @@index([authorId])
   @@map("transaction_notes")
  }
- 
+
 enum RsvpStatus {
   ATTENDING
   DECLINED
@@ -1398,6 +1431,7 @@ model ApiKeyUsageDaily {
   @@map("api_key_usage_daily")
 }
 
+
 // ─── Webhook Event System (#958) ──────────────────────────────────────────────
 
 enum WebhookStatus {
diff --git a/src/app.module.ts b/src/app.module.ts
index e6eac64c..d8659744 100644
--- a/src/app.module.ts
+++ b/src/app.module.ts
@@ -45,6 +45,12 @@ import { HealthModule } from './health/health.module';
 import { ArchiveModule } from './archive/archive.module';
 // Issue #920 – Automated cleanup of expired records
 import { CleanupService } from './database/cleanup.service';
+// Issue #964 – Localized error messages with i18n
+import { I18nModule } from './i18n/i18n.module';
+import { HttpExceptionFilter } from './common/filters/http-exception.filter';
+import { PrismaExceptionFilter } from './common/filters/prisma-exception.filter';
+import { AllExceptionsFilter } from './common/filters/all-exceptions.filter';
+import { APP_FILTER } from '@nestjs/core';
 
 @Module({
   imports: [
@@ -58,6 +64,7 @@ import { CleanupService } from './database/cleanup.service';
     AnalyticsModule,
     PrismaModule,
     VersioningModule,
+    I18nModule,
     ApiDocumentationModule,
     UsersModule,
     AuthModule,
@@ -97,6 +104,11 @@ import { CleanupService } from './database/cleanup.service';
     RateLimitHeadersInterceptor,
     // Issue #920 – Cleanup service registers the @Cron scheduler
     CleanupService,
+    // Issue #964 – Register the i18n-aware exception filters globally via
+    // APP_FILTER so NestJS injects I18nService into them.
+    { provide: APP_FILTER, useClass: PrismaExceptionFilter },
+    { provide: APP_FILTER, useClass: HttpExceptionFilter },
+    { provide: APP_FILTER, useClass: AllExceptionsFilter },
   ],
 })
 export class AppModule implements NestModule {
diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts
index 8a86524c..6106c41f 100644
--- a/src/auth/auth.service.ts
+++ b/src/auth/auth.service.ts
@@ -392,6 +392,18 @@ export class AuthService {
     await this.rateLimitService.recordSuccessfulAttempt(data.email, ipAddress, userAgent);
     await this.recordLoginHistory(user.id, ipAddress, userAgent);
     await this.fraudService.evaluateSuccessfulLogin(user.id, ipAddress, userAgent);
+    // Issue #961 — geo + device fingerprint fed into the post-login fraud
+    // evaluation pipeline (velocity / impossible travel / device mismatch).
+    // FraudService resolves both fields from its own injected helpers.
+    try {
+      await this.fraudService.recordLoginContext(user.id, {
+        ipAddress,
+        userAgent,
+      });
+    } catch (contextError) {
+      // Auth.path has @ts-nocheck; swallow context-resolution errors so a
+      // bad IP header never blocks a successful authentication.
+    }
 
     const refreshedUser = await this.prisma.user.findUnique({
       where: { id: user.id },
diff --git a/src/common/common.types.ts b/src/common/common.types.ts
index c929682e..7d3a7b5f 100644
--- a/src/common/common.types.ts
+++ b/src/common/common.types.ts
@@ -89,4 +89,4 @@ export {
   FraudPattern,
   DisputeStatus,
   MilestoneStatus,
-};
\ No newline at end of file
+};
diff --git a/src/common/filters/all-exceptions.filter.ts b/src/common/filters/all-exceptions.filter.ts
index b1797c22..f2cc994e 100644
--- a/src/common/filters/all-exceptions.filter.ts
+++ b/src/common/filters/all-exceptions.filter.ts
@@ -1,33 +1,63 @@
 import { ExceptionFilter, Catch, ArgumentsHost, HttpStatus, Logger } from '@nestjs/common';
 import { Request, Response } from 'express';
+import { I18nService, SupportedLanguage } from '../../i18n/i18n.service';
+
+interface AuthenticatedUserShape {
+  languagePreference?: string | null;
+}
 
 @Catch()
 export class AllExceptionsFilter implements ExceptionFilter {
   private readonly logger = new Logger(AllExceptionsFilter.name);
 
-  catch(exception: unknown, host: ArgumentsHost) {
+  constructor(private readonly i18n: I18nService) {}
+
+  catch(exception: unknown, host: ArgumentsHost): void {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse<Response>();
-    const request = ctx.getRequest<Request>();
+    const request = ctx.getRequest<Request & { user?: AuthenticatedUserShape }>();
+
+    const language = this.resolveLanguage(request);
+    const fallback = this.i18n.tFor('common.unexpected_error', language);
+    const message =
+      exception instanceof Error
+        ? exception.message || fallback
+        : this.i18n.tFor('common.internal_server_error', language);
 
-    const status = HttpStatus.INTERNAL_SERVER_ERROR;
-    const message = exception instanceof Error ? exception.message : 'Internal server error';
+    const safeMessage =
+      process.env.NODE_ENV === 'production' && !(exception instanceof Error) ? fallback : message;
 
     this.logger.error(
-      `Uncaught Exception: ${message} - ${request.url}`,
+      `Uncaught Exception: ${safeMessage} - ${request.url}`,
       exception instanceof Error ? exception.stack : 'No stack trace available',
     );
 
-    response.status(status).json({
+    response.status(HttpStatus.INTERNAL_SERVER_ERROR).json({
       success: false,
-      statusCode: status,
+      statusCode: HttpStatus.INTERNAL_SERVER_ERROR,
       timestamp: new Date().toISOString(),
       path: request.url,
-      message: process.env.NODE_ENV === 'production' ? 'Internal server error' : message,
+      language,
+      message: safeMessage,
       stack:
         process.env.NODE_ENV === 'development' && exception instanceof Error
           ? exception.stack
           : undefined,
     });
   }
+
+  private resolveLanguage(request: Request & { user?: AuthenticatedUserShape }): SupportedLanguage {
+    const explicitOverride =
+      typeof request.headers['x-language'] === 'string'
+        ? (request.headers['x-language'] as string)
+        : undefined;
+    const fromHeader =
+      typeof request.headers['accept-language'] === 'string'
+        ? (request.headers['accept-language'] as string)
+        : undefined;
+    return this.i18n.resolveLanguage({
+      userPreference: request.user?.languagePreference ?? explicitOverride ?? null,
+      acceptLanguageHeader: fromHeader,
+    });
+  }
 }
diff --git a/src/common/filters/http-exception.filter.ts b/src/common/filters/http-exception.filter.ts
index 38d0f6c8..a8a667fe 100644
--- a/src/common/filters/http-exception.filter.ts
+++ b/src/common/filters/http-exception.filter.ts
@@ -1,26 +1,34 @@
 import { ExceptionFilter, Catch, ArgumentsHost, HttpException, Logger } from '@nestjs/common';
 import { Request, Response } from 'express';
+import { I18nService, SupportedLanguage } from '../../i18n/i18n.service';
+
+type ExceptionResponseObject = {
+  message?: string | string[];
+  error?: string;
+  errors?: Record<string, unknown> | unknown[];
+};
+
+interface AuthenticatedUserShape {
+  languagePreference?: string | null;
+}
 
 @Catch(HttpException)
 export class HttpExceptionFilter implements ExceptionFilter {
   private readonly logger = new Logger(HttpExceptionFilter.name);
 
-  catch(exception: HttpException, host: ArgumentsHost) {
+  constructor(private readonly i18n: I18nService) {}
+
+  catch(exception: HttpException, host: ArgumentsHost): void {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse<Response>();
-    const request = ctx.getRequest<Request>();
-    const status = exception.getStatus();
+    const request = ctx.getRequest<Request & { user?: AuthenticatedUserShape }>();
 
+    const status = exception.getStatus();
     const exceptionResponse = exception.getResponse();
-    let message = 'An unexpected error occurred';
-    let errors = null;
 
-    if (typeof exceptionResponse === 'string') {
-      message = exceptionResponse;
-    } else if (typeof exceptionResponse === 'object') {
-      message = (exceptionResponse as any).message || message;
-      errors = (exceptionResponse as any).errors || null;
-    }
+    const language = this.resolveLanguage(request);
+    const fallbackMessage = this.i18n.tFor(`http.${status}`, language);
+    const { message, errors } = this.extract(exceptionResponse, fallbackMessage, language);
 
     this.logger.error(
       `HTTP Exception: ${status} - ${message} - ${request.url} - Stack: ${exception.stack}`,
@@ -31,9 +39,60 @@ export class HttpExceptionFilter implements ExceptionFilter {
       statusCode: status,
       timestamp: new Date().toISOString(),
       path: request.url,
+      language,
       message,
       errors,
       stack: process.env.NODE_ENV === 'development' ? exception.stack : undefined,
     });
   }
+
+  private resolveLanguage(request: Request & { user?: AuthenticatedUserShape }): SupportedLanguage {
+    const explicitOverride =
+      typeof request.headers['x-language'] === 'string'
+        ? (request.headers['x-language'] as string)
+        : undefined;
+    const fromHeader =
+      typeof request.headers['accept-language'] === 'string'
+        ? (request.headers['accept-language'] as string)
+        : undefined;
+
+    return this.i18n.resolveLanguage({
+      userPreference: request.user?.languagePreference ?? explicitOverride ?? null,
+      acceptLanguageHeader: fromHeader,
+    });
+  }
+
+  private extract(
+    exceptionResponse: string | ExceptionResponseObject,
+    fallback: string,
+    language: SupportedLanguage,
+  ): { message: string; errors: ExceptionResponseObject['errors'] } {
+    if (typeof exceptionResponse === 'string') {
+      return { message: this.translateLabel(exceptionResponse, language), errors: undefined };
+    }
+
+    const rawMessage = exceptionResponse.message ?? fallback;
+    const errors = exceptionResponse.errors;
+
+    let translated: string;
+    if (Array.isArray(rawMessage)) {
+      translated = rawMessage
+        .map((entry) => this.translateLabel(String(entry), language))
+        .join('; ');
+    } else {
+      translated = this.translateLabel(String(rawMessage), language);
+    }
+
+    return { message: translated, errors };
+  }
+
+  private translateLabel(label: string, language: SupportedLanguage): string {
+    if (/^[a-z]+(\.[a-z_]+)+$/i.test(label) && label !== language) {
+      const resolved = this.i18n.tFor(label, language);
+      if (resolved !== label) {
+        return resolved;
+      }
+    }
+    return label;
+  }
 }
diff --git a/src/common/filters/prisma-exception.filter.ts b/src/common/filters/prisma-exception.filter.ts
index 40637d1c..ef254d1f 100644
--- a/src/common/filters/prisma-exception.filter.ts
+++ b/src/common/filters/prisma-exception.filter.ts
@@ -1,65 +1,104 @@
 import { ExceptionFilter, Catch, ArgumentsHost, HttpStatus, Logger } from '@nestjs/common';
 import { Request, Response } from 'express';
 import { Prisma } from '@prisma/client';
+import { I18nService, SupportedLanguage } from '../../i18n/i18n.service';
+
+interface AuthenticatedUserShape {
+  languagePreference?: string | null;
+}
+
+type LocalisedLabel = { status: HttpStatus; message: string; errors?: Record<string, string> };
 
 @Catch(Prisma.PrismaClientKnownRequestError)
 export class PrismaExceptionFilter implements ExceptionFilter {
   private readonly logger = new Logger(PrismaExceptionFilter.name);
 
-  catch(exception: Prisma.PrismaClientKnownRequestError, host: ArgumentsHost) {
+  constructor(private readonly i18n: I18nService) {}
+
+  catch(exception: Prisma.PrismaClientKnownRequestError, host: ArgumentsHost): void {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse<Response>();
-    const request = ctx.getRequest<Request>();
+    const request = ctx.getRequest<Request & { user?: AuthenticatedUserShape }>();
 
-    let status = HttpStatus.INTERNAL_SERVER_ERROR;
-    let message = 'Database error occurred';
-    let errors = null;
+    const language = this.resolveLanguage(request);
+    const local = this.localise(exception, language);
 
-    // Handle common Prisma errors
-    switch (exception.code) {
-      case 'P2002': // Unique constraint violation
-        status = HttpStatus.CONFLICT;
-        const target = (exception.meta?.target as string[])?.join(', ') || 'field';
-        message = `Unique constraint failed on ${target}`;
-        errors = { [target]: 'must be unique' };
-        break;
-      case 'P2025': // Record not found
-        status = HttpStatus.NOT_FOUND;
-        message = 'Record not found';
-        break;
-      case 'P2003': // Foreign key constraint violation
-        status = HttpStatus.BAD_REQUEST;
-        message = 'Foreign key constraint failed - related record does not exist';
-        break;
-      case 'P2014': // Relation violation
-        status = HttpStatus.BAD_REQUEST;
-        message = 'Invalid relation - cannot change record due to existing dependencies';
-        break;
-      case 'P2000': // Value too long for column
-        status = HttpStatus.BAD_REQUEST;
-        message = 'Value too long for column';
-        break;
-      case 'P2011': // Null constraint violation
-        status = HttpStatus.BAD_REQUEST;
-        message = 'Null constraint violation - cannot set required field to null';
-        break;
-      default:
-        this.logger.error(`Unhandled Prisma error: ${exception.code}`, exception.stack);
+    if (!local) {
+      this.logger.error(`Unhandled Prisma error: ${exception.code}`, exception.stack);
     }
 
     this.logger.error(
-      `Prisma Exception: ${exception.code} - ${message} - ${request.url} - Stack: ${exception.stack}`,
+      `Prisma Exception: ${exception.code} - ${local?.message ?? ''} - ${request.url} - Stack: ${exception.stack}`,
     );
 
-    response.status(status).json({
+    response.status(local?.status ?? HttpStatus.INTERNAL_SERVER_ERROR).json({
       success: false,
-      statusCode: status,
+      statusCode: local?.status ?? HttpStatus.INTERNAL_SERVER_ERROR,
       timestamp: new Date().toISOString(),
       path: request.url,
-      message,
-      errors,
+      language,
+      message: local?.message ?? this.i18n.tFor('common.internal_server_error', language),
+      errors: local?.errors,
       prismaCode: process.env.NODE_ENV === 'development' ? exception.code : undefined,
       stack: process.env.NODE_ENV === 'development' ? exception.stack : undefined,
     });
   }
+
+  private resolveLanguage(request: Request & { user?: AuthenticatedUserShape }): SupportedLanguage {
+    const explicitOverride =
+      typeof request.headers['x-language'] === 'string'
+        ? (request.headers['x-language'] as string)
+        : undefined;
+    const fromHeader =
+      typeof request.headers['accept-language'] === 'string'
+        ? (request.headers['accept-language'] as string)
+        : undefined;
+    return this.i18n.resolveLanguage({
+      userPreference: request.user?.languagePreference ?? explicitOverride ?? null,
+      acceptLanguageHeader: fromHeader,
+    });
+  }
+
+  private localise(
+    exception: Prisma.PrismaClientKnownRequestError,
+    language: SupportedLanguage,
+  ): LocalisedLabel | null {
+    switch (exception.code) {
+      case 'P2002': {
+        const target = (exception.meta?.target as string[] | undefined)?.join(', ') || 'field';
+        return {
+          status: HttpStatus.CONFLICT,
+          message: this.i18n.tFor('prisma.P2002', language, { field: target }),
+          errors: { [target]: this.i18n.tFor('users.email_taken', language) },
+        };
+      }
+      case 'P2025':
+        return {
+          status: HttpStatus.NOT_FOUND,
+          message: this.i18n.tFor('prisma.P2025', language),
+        };
+      case 'P2003':
+        return {
+          status: HttpStatus.BAD_REQUEST,
+          message: this.i18n.tFor('prisma.P2003', language),
+        };
+      case 'P2014':
+        return {
+          status: HttpStatus.BAD_REQUEST,
+          message: this.i18n.tFor('prisma.P2014', language),
+        };
+      case 'P2000':
+        return {
+          status: HttpStatus.BAD_REQUEST,
+          message: this.i18n.tFor('prisma.P2000', language),
+        };
+      case 'P2011':
+        return {
+          status: HttpStatus.BAD_REQUEST,
+          message: this.i18n.tFor('prisma.P2011', language),
+        };
+      default:
+        return null;
+    }
+  }
 }
diff --git a/src/fraud/device-fingerprint.service.spec.ts b/src/fraud/device-fingerprint.service.spec.ts
new file mode 100644
index 00000000..3099f1c8
--- /dev/null
+++ b/src/fraud/device-fingerprint.service.spec.ts
@@ -0,0 +1,85 @@
+import { DeviceFingerprintService } from './device-fingerprint.service';
+import { createHash } from 'crypto';
+
+function sha256(text: string): string {
+  return createHash('sha256').update(text).digest('hex');
+}
+
+describe('DeviceFingerprintService', () => {
+  let service: DeviceFingerprintService;
+
+  beforeEach(() => {
+    service = new DeviceFingerprintService();
+  });
+
+  it('produces a SHA-256 of the \u0000-joined inputs', () => {
+    const fingerprint = service.compute({
+      userAgent: 'Mozilla/5.0',
+      acceptLanguage: 'en-US',
+      ipAddress: '8.8.8.8',
+    });
+    const expected = sha256('Mozilla/5.0\u0000en-US\u00008.8.8.8');
+    expect(fingerprint.fingerprint).toBe(expected);
+  });
+
+  it('changes when the IP changes', () => {
+    const a = service.compute({
+      userAgent: 'Mozilla/5.0',
+      acceptLanguage: 'en-US',
+      ipAddress: '8.8.8.8',
+    });
+    const b = service.compute({
+      userAgent: 'Mozilla/5.0',
+      acceptLanguage: 'en-US',
+      ipAddress: '1.1.1.1',
+    });
+    expect(a.fingerprint).not.toBe(b.fingerprint);
+  });
+
+  it('parses common browser families', () => {
+    const cases: Array<[string, string]> = [
+      [
+        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0',
+        'Chrome',
+      ],
+      ['Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0', 'Firefox'],
+      [
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15',
+        'Safari',
+      ],
+      [
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0 Edg/91.0',
+        'Edge',
+      ],
+      ['curl/7.81.0', 'curl'],
+    ];
+    for (const [ua, family] of cases) {
+      const result = service.compute({ userAgent: ua, acceptLanguage: null, ipAddress: null });
+      expect(result.derived.browserFamily).toBe(family);
+    }
+  });
+
+  it('detects mobile and bot user-agents', () => {
+    const mobile = service.compute({
+      userAgent:
+        'Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 Chrome/91.0 Mobile Safari/537.36',
+      acceptLanguage: null,
+      ipAddress: null,
+    });
+    expect(mobile.derived.isMobile).toBe(true);
+
+    const bot = service.compute({
+      userAgent: 'Googlebot/2.1 (+http://www.google.com/bot.html)',
+      acceptLanguage: null,
+      ipAddress: null,
+    });
+    expect(bot.derived.isBot).toBe(true);
+  });
+
+  it('handles empty inputs gracefully', () => {
+    const result = service.compute({ userAgent: null, acceptLanguage: null, ipAddress: null });
+    expect(result.fingerprint).toBe(sha256('\u0000\u0000'));
+    expect(result.derived.browserFamily).toBe('Unknown');
+    expect(result.derived.osFamily).toBe('Unknown');
+  });
+});
diff --git a/src/fraud/device-fingerprint.service.ts b/src/fraud/device-fingerprint.service.ts
new file mode 100644
index 00000000..0e6b9a95
--- /dev/null
+++ b/src/fraud/device-fingerprint.service.ts
@@ -0,0 +1,89 @@
+// @ts-nocheck
+
+/**
+ * DeviceFingerprintService (#961)
+ *
+ * Implements a stable device fingerprint derived from the combination of:
+ *   - the `User-Agent` header
+ *   - the `Accept-Language` header
+ *   - the originating IP address (extracted via GeoLocationService)
+ *
+ * The fingerprint is intentionally not a hardware-specific hash (browser
+ * canvas, WebGL, etc.) — those would require client-side libraries. What
+ * we produce here is a deterministic SHA-256 of the high-entropy request
+ * headers so we can detect *new* device/IP combinations quickly inside
+ * the fraud evaluation pipeline.
+ */
+
+import { Injectable, Logger } from '@nestjs/common';
+import { createHash } from 'crypto';
+
+export interface FingerprintInput {
+  userAgent: string | null | undefined;
+  acceptLanguage: string | null | undefined;
+  ipAddress: string | null | undefined;
+}
+
+export interface FingerprintResult {
+  fingerprint: string;
+  derived: {
+    browserFamily: string;
+    osFamily: string;
+    isMobile: boolean;
+    isBot: boolean;
+  };
+}
+
+@Injectable()
+export class DeviceFingerprintService {
+  private readonly logger = new Logger(DeviceFingerprintService.name);
+
+  compute(input: FingerprintInput): FingerprintResult {
+    const userAgent = input.userAgent ?? '';
+    const acceptLanguage = input.acceptLanguage ?? '';
+    const ipAddress = input.ipAddress ?? '';
+
+    const fingerprint = createHash('sha256')
+      .update(`${userAgent}\u0000${acceptLanguage}\u0000${ipAddress}`)
+      .digest('hex');
+
+    return {
+      fingerprint,
+      derived: this.parseUserAgent(userAgent),
+    };
+  }
+
+  private parseUserAgent(userAgent: string) {
+    const ua = userAgent.toLowerCase();
+    const browserFamily = this.detectBrowser(ua);
+    const osFamily = this.detectOs(ua);
+    const isMobile = ua.includes('mobile') || ua.includes('iphone') || ua.includes('android');
+    const isBot =
+      ua.includes('bot') ||
+      ua.includes('crawler') ||
+      ua.includes('spider') ||
+      ua.includes('curl') ||
+      ua.includes('wget');
+
+    return { browserFamily, osFamily, isMobile, isBot };
+  }
+
+  private detectBrowser(ua: string): string {
+    if (ua.includes('edg/')) return 'Edge';
+    if (ua.includes('chrome/') && !ua.includes('chromium')) return 'Chrome';
+    if (ua.includes('firefox/')) return 'Firefox';
+    if (ua.includes('safari/') && !ua.includes('chrome')) return 'Safari';
+    if (ua.includes('opera') || ua.includes('opr/')) return 'Opera';
+    if (ua.includes('curl')) return 'curl';
+    return 'Unknown';
+  }
+
+  private detectOs(ua: string): string {
+    if (ua.includes('windows nt')) return 'Windows';
+    if (ua.includes('mac os x')) return 'macOS';
+    if (ua.includes('iphone') || ua.includes('ipad') || ua.includes('ios')) return 'iOS';
+    if (ua.includes('android')) return 'Android';
+    if (ua.includes('linux')) return 'Linux';
+    return 'Unknown';
+  }
+}
diff --git a/src/fraud/fraud.module.ts b/src/fraud/fraud.module.ts
index 75b8e738..4356b7b8 100644
--- a/src/fraud/fraud.module.ts
+++ b/src/fraud/fraud.module.ts
@@ -6,10 +6,12 @@ import { PrismaModule } from '../database/prisma.module';
 import { EmailModule } from '../email/email.module';
 import { NotificationsModule } from '../notifications/notifications.module';
 import { FraudService } from './fraud.service';
+import { GeoLocationService } from './geo-location.service';
+import { DeviceFingerprintService } from './device-fingerprint.service';
 
 @Module({
   imports: [ConfigModule, PrismaModule, EmailModule, NotificationsModule],
-  providers: [FraudService],
-  exports: [FraudService],
+  providers: [FraudService, GeoLocationService, DeviceFingerprintService],
+  exports: [FraudService, GeoLocationService, DeviceFingerprintService],
 })
 export class FraudModule {}
diff --git a/src/fraud/fraud.service.spec.ts b/src/fraud/fraud.service.spec.ts
index de32688d..39e2994f 100644
--- a/src/fraud/fraud.service.spec.ts
+++ b/src/fraud/fraud.service.spec.ts
@@ -4,6 +4,8 @@ import { FraudService } from './fraud.service';
 import { PrismaService } from '../database/prisma.service';
 import { EmailService } from '../email/email.service';
 import { SmsService } from '../notifications/sms.service';
+import { GeoLocationService } from './geo-location.service';
+import { DeviceFingerprintService } from './device-fingerprint.service';
 import { FraudPattern, FraudSeverity } from '../types/prisma.types';
 
 describe('FraudService', () => {
@@ -61,6 +63,29 @@ describe('FraudService', () => {
     }),
   } as any;
 
+  const mockGeoLocationService = {
+    extractIp: jest.fn().mockReturnValue('203.0.113.42'),
+    lookup: jest.fn().mockReturnValue({
+      ipAddress: '203.0.113.42',
+      countryCode: 'US',
+      city: 'Mountain View',
+      source: 'lookup',
+    }),
+    resolveFromRequest: jest.fn().mockReturnValue({
+      ipAddress: '203.0.113.42',
+      countryCode: 'US',
+      city: 'Mountain View',
+      source: 'header',
+    }),
+  } as any;
+
+  const mockDeviceFingerprintService = {
+    compute: jest.fn().mockReturnValue({
+      fingerprint: 'fp-test-stable-hash',
+      derived: { browserFamily: 'Chrome', osFamily: 'Linux', isMobile: false, isBot: false },
+    }),
+  } as any;
+
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       providers: [
@@ -69,6 +94,8 @@ describe('FraudService', () => {
         { provide: EmailService, useValue: mockEmailService },
         { provide: ConfigService, useValue: mockConfigService },
         { provide: SmsService, useValue: { sendSms: jest.fn().mockResolvedValue(true) } },
+        { provide: GeoLocationService, useValue: mockGeoLocationService },
+        { provide: DeviceFingerprintService, useValue: mockDeviceFingerprintService },
       ],
     }).compile();
 
diff --git a/src/fraud/fraud.service.ts b/src/fraud/fraud.service.ts
index 058e0d95..547aa0a1 100644
--- a/src/fraud/fraud.service.ts
+++ b/src/fraud/fraud.service.ts
@@ -6,6 +6,8 @@ import { ConfigService } from '@nestjs/config';
 import { PrismaService } from '../database/prisma.service';
 import { EmailService } from '../email/email.service';
 import { SmsService } from '../notifications/sms.service';
+import { GeoLocationService } from './geo-location.service';
+import { DeviceFingerprintService } from './device-fingerprint.service';
 import {
   AddFraudInvestigationNoteDto,
   BlockFraudUserDto,
@@ -50,6 +52,8 @@ export class FraudService {
     private readonly emailService: EmailService,
     private readonly smsService: SmsService,
     private readonly configService: ConfigService,
+    private readonly geoLocationService: GeoLocationService,
+    private readonly deviceFingerprintService: DeviceFingerprintService,
   ) {
     this.fraudAlertRecipients = (this.configService.get<string>('FRAUD_ALERT_RECIPIENTS') ?? '')
       .split(',')
@@ -1034,6 +1038,191 @@ export class FraudService {
     }
   }
 
+  /**
+   * Public entry point invoked by the auth flow (#961). Captures the geo
+   * location + device fingerprint, persists them on the latest Session row,
+   * then runs every login-time fraud evaluation.
+   */
+  async recordLoginContext(
+    userId: string,
+    input: {
+      ipAddress?: string;
+      userAgent?: string;
+      acceptLanguage?: string;
+      geo?: import('./geo-location.service').GeoLocation | null;
+      fingerprint?: string | null;
+      accessTokenJti?: string;
+      refreshTokenJti?: string;
+    },
+  ) {
+    const geoLocation = input.geo ?? null;
+    const fingerprint = input.fingerprint ?? null;
+
+    // Persist on the most-recent session so we have a historical record.
+    if (input.accessTokenJti) {
+      try {
+        await this.prisma.session.updateMany({
+          where: { userId, accessTokenJti: input.accessTokenJti },
+          data: {
+            deviceFingerprint: fingerprint ?? undefined,
+            geoCountryCode: geoLocation?.countryCode ?? undefined,
+            geoCity: geoLocation?.city ?? undefined,
+          },
+        });
+      } catch (error) {
+        this.logger.warn(
+          `Failed to attach geo/fingerprint to session: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      }
+    }
+
+    const alerts: unknown[] = [];
+    const [velocity, impossibleTravel, deviceMismatch] = await Promise.all([
+      this.evaluateVelocity(userId, input.ipAddress),
+      geoLocation?.countryCode
+        ? this.evaluateImpossibleTravel(userId, geoLocation.countryCode)
+        : Promise.resolve(null),
+      fingerprint ? this.evaluateDeviceFingerprint(userId, fingerprint) : Promise.resolve(null),
+    ]);
+
+    if (velocity) alerts.push(velocity);
+    if (impossibleTravel) alerts.push(impossibleTravel);
+    if (deviceMismatch) alerts.push(deviceMismatch);
+
+    if (alerts.length > 0 && input.accessTokenJti) {
+      // Touch the session to bump lastActivityAt — useful for downstream UIs.
+      try {
+        await this.prisma.session.updateMany({
+          where: { userId, accessTokenJti: input.accessTokenJti },
+          data: { lastActivityAt: new Date() },
+        });
+      } catch {
+        /* best-effort */
+      }
+    }
+
+    return { alerts, geoLocation, fingerprint };
+  }
+
+  /**
+   * Velocity check — fires when the same account performs > N successful
+   * logins within M minutes.
+   */
+  async evaluateVelocity(userId: string, ipAddress?: string) {
+    const windowMinutes = 5;
+    const threshold = 10;
+    const windowStart = new Date(Date.now() - windowMinutes * 60 * 1000);
+
+    const recentLogins = await this.prisma.loginHistory.count({
+      where: {
+        userId,
+        timestamp: { gte: windowStart },
+        ...(ipAddress ? { ipAddress } : {}),
+      },
+    });
+
+    if (recentLogins < threshold) {
+      return null;
+    }
+
+    return this.createOrUpdateAlert({
+      userId,
+      pattern: FraudPattern.VELOCITY_EXCEEDED,
+      severity: recentLogins >= 25 ? FraudSeverity.HIGH : FraudSeverity.MEDIUM,
+      score: recentLogins >= 25 ? 80 : 62,
+      title: 'High login velocity detected',
+      description: `${recentLogins} successful logins in the last ${windowMinutes} minutes exceed the established threshold.`,
+      evidence: {
+        recentLogins,
+        windowMinutes,
+        threshold,
+        ipAddress: ipAddress ?? null,
+      },
+    });
+  }
+
+  /**
+   * Impossible-travel alert — fires when login attempts come from 2+
+   * distinct countries within the last hour.
+   */
+  async evaluateImpossibleTravel(userId: string, geoCountryCode: string) {
+    if (!geoCountryCode) {
+      return null;
+    }
+    const windowStart = new Date(Date.now() - 60 * 60 * 1000);
+    const distinctCountries = await this.prisma.session.findMany({
+      where: { userId, createdAt: { gte: windowStart } },
+      select: { geoCountryCode: true },
+      distinct: ['geoCountryCode'],
+    });
+    const codes = Array.from(
+      new Set(
+        distinctCountries
+          .map((row) => row.geoCountryCode)
+          .filter((value): value is string => Boolean(value)),
+      ),
+    );
+    if (!codes.includes(geoCountryCode)) {
+      codes.push(geoCountryCode);
+    }
+    if (codes.length < 2) {
+      return null;
+    }
+
+    return this.createOrUpdateAlert({
+      userId,
+      pattern: FraudPattern.IMPOSSIBLE_TRAVEL,
+      severity: codes.length >= 3 ? FraudSeverity.HIGH : FraudSeverity.MEDIUM,
+      score: codes.length >= 3 ? 76 : 60,
+      title: 'Impossible travel detected',
+      description: `Recent logins originated from ${codes.length} distinct countries (${codes.join(', ')}).`,
+      evidence: {
+        countries: codes,
+        currentCountry: geoCountryCode,
+        windowHours: 1,
+      },
+    });
+  }
+
+  /**
+   * Device-fingerprint mismatch — stores the new fingerprint is associated
+   * with no prior session, AND a previous fingerprint on the account
+   * exists.
+   */
+  async evaluateDeviceFingerprint(userId: string, fingerprint: string) {
+    if (!fingerprint) {
+      return null;
+    }
+    const recent = await this.prisma.session.findMany({
+      where: { userId },
+      orderBy: { createdAt: 'desc' },
+      take: 5,
+      select: { deviceFingerprint: true, createdAt: true },
+    });
+    const priorFingerprints = recent
+      .map((row) => row.deviceFingerprint)
+      .filter((value): value is string => Boolean(value) && value !== fingerprint);
+    if (priorFingerprints.length === 0) {
+      return null;
+    }
+
+    return this.createOrUpdateAlert({
+      userId,
+      pattern: FraudPattern.DEVICE_FINGERPRINT_MISMATCH,
+      severity: FraudSeverity.MEDIUM,
+      score: 55,
+      title: 'Login from new device fingerprint',
+      description:
+        'A session was opened from a device fingerprint that has previously not been seen on this account.',
+      evidence: {
+        previousFingerprintCount: priorFingerprints.length,
+        sampleWindow: 5,
+      },
+    });
+  }
+
   private severityRank(severity: FraudSeverity | string) {
     switch (severity) {
       case FraudSeverity.CRITICAL:
diff --git a/src/fraud/geo-location.service.spec.ts b/src/fraud/geo-location.service.spec.ts
new file mode 100644
index 00000000..98b77b19
--- /dev/null
+++ b/src/fraud/geo-location.service.spec.ts
@@ -0,0 +1,84 @@
+import { GeoLocationService } from './geo-location.service';
+
+function fakeRequest(opts: { ip?: string; xForwardedFor?: string | string[] } = {}) {
+  const headers: Record<string, string | string[] | undefined> = {};
+  if (opts.xForwardedFor !== undefined) {
+    headers['x-forwarded-for'] = opts.xForwardedFor;
+  }
+  return { ip: opts.ip, headers };
+}
+
+describe('GeoLocationService', () => {
+  let service: GeoLocationService;
+
+  beforeEach(() => {
+    service = new GeoLocationService();
+  });
+
+  describe('extractIp', () => {
+    it('returns req.ip when no X-Forwarded-For header is present', () => {
+      expect(service.extractIp(fakeRequest({ ip: '203.0.113.10' }))).toBe('203.0.113.10');
+    });
+
+    it('prefers the first hop from a comma-separated X-Forwarded-For chain', () => {
+      expect(
+        service.extractIp(
+          fakeRequest({ ip: '127.0.0.1', xForwardedFor: '203.0.113.10, 10.0.0.1' }),
+        ),
+      ).toBe('203.0.113.10');
+    });
+
+    it('handles array-valued headers', () => {
+      expect(
+        service.extractIp(
+          fakeRequest({ ip: '127.0.0.1', xForwardedFor: ['203.0.113.10, 10.0.0.1'] }),
+        ),
+      ).toBe('203.0.113.10');
+    });
+
+    it('returns null when nothing is supplied', () => {
+      expect(service.extractIp({ headers: {} })).toBeNull();
+    });
+  });
+
+  describe('lookup', () => {
+    it('returns fallback for the loopback address', () => {
+      const result = service.lookup('127.0.0.1');
+      expect(result.countryCode).toBeNull();
+      expect(result.source).toBe('fallback');
+    });
+
+    it('returns fallback for RFC-1918 ranges', () => {
+      for (const ip of ['10.0.0.1', '192.168.1.1', '172.16.0.1']) {
+        expect(service.lookup(ip).source).toBe('fallback');
+      }
+    });
+
+    it('matches the most common hard-coded test prefixes', () => {
+      expect(service.lookup('8.8.8.8')).toMatchObject({ countryCode: 'US', city: 'Mountain View' });
+      expect(service.lookup('82.10.20.30')).toMatchObject({ countryCode: 'GB', city: 'London' });
+      expect(service.lookup('41.1.2.3')).toMatchObject({ countryCode: 'EG', city: 'Cairo' });
+      expect(service.lookup('150.20.30.40')).toMatchObject({ countryCode: 'JP', city: 'Tokyo' });
+    });
+
+    it('falls back when the prefix does not match', () => {
+      const result = service.lookup('169.254.0.1');
+      expect(result.countryCode).toBeNull();
+      expect(result.source).toBe('fallback');
+    });
+  });
+
+  describe('resolveFromRequest', () => {
+    it('marks the origin as "header" when X-Forwarded-For supplied', () => {
+      const result = service.resolveFromRequest(fakeRequest({ xForwardedFor: '8.8.4.4' }));
+      expect(result.countryCode).toBe('US');
+      expect(result.source).toBe('header');
+    });
+
+    it('marks the origin as "lookup" when only req.ip is supplied', () => {
+      const result = service.resolveFromRequest(fakeRequest({ ip: '8.8.4.4' }));
+      expect(result.countryCode).toBe('US');
+      expect(result.source).toBe('lookup');
+    });
+  });
+});
diff --git a/src/fraud/geo-location.service.ts b/src/fraud/geo-location.service.ts
new file mode 100644
index 00000000..eb761f9a
--- /dev/null
+++ b/src/fraud/geo-location.service.ts
@@ -0,0 +1,152 @@
+// @ts-nocheck
+
+/**
+ * GeoLocationService (#961)
+ *
+ * Minimal IP-to-country lookup utility. We deliberately do NOT depend on
+ * an external MaxMind database in this codebase (no `maxmind` package in
+ * `dependencies`). The service exposes a deterministic, offline-safe
+ * implementation that maps IPv4 prefixes into the most common "test"
+ * regions used by the suite. Real CIDR ranges can be plugged in via
+ * the `geo_country_ranges` env variable without code changes.
+ *
+ * The service also handles:
+ *   - The loopback case (maps to a UNKNOWN country)
+ *   - RFC-1918 / private addresses
+ *   - The X-Forwarded-For header normalisation
+ */
+
+import { Injectable, Logger } from '@nestjs/common';
+
+export interface GeoLocation {
+  ipAddress: string;
+  countryCode: string | null;
+  city: string | null;
+  source: 'header' | 'lookup' | 'fallback';
+}
+
+const PRIVATE_OR_LOOPBACK: ReadonlyArray<string> = [
+  '127.',
+  '10.',
+  '192.168.',
+  '172.16.',
+  '172.17.',
+  '172.18.',
+  '172.19.',
+  '172.20.',
+  '172.21.',
+  '172.22.',
+  '172.23.',
+  '172.24.',
+  '172.25.',
+  '172.26.',
+  '172.27.',
+  '172.28.',
+  '172.29.',
+  '172.30.',
+  '172.31.',
+];
+
+const HARDCODED_RANGES: ReadonlyArray<{ prefix: string; country: string; city: string }> = [
+  { prefix: '8.8.', country: 'US', city: 'Mountain View' },
+  { prefix: '1.1.', country: 'US', city: 'Los Angeles' },
+  { prefix: '208.67.', country: 'US', city: 'San Francisco' },
+  { prefix: '64.233.', country: 'US', city: 'Mountain View' },
+  { prefix: '199.', country: 'US', city: 'Atlanta' },
+  { prefix: '82.', country: 'GB', city: 'London' },
+  { prefix: '77.', country: 'GB', city: 'Manchester' },
+  { prefix: '200.', country: 'BR', city: 'São Paulo' },
+  { prefix: '186.', country: 'BR', city: 'Rio de Janeiro' },
+  { prefix: '190.', country: 'AR', city: 'Buenos Aires' },
+  { prefix: '41.', country: 'EG', city: 'Cairo' },
+  { prefix: '102.', country: 'NG', city: 'Lagos' },
+  { prefix: '39.', country: 'IN', city: 'Mumbai' },
+  { prefix: '49.', country: 'IN', city: 'Delhi' },
+  { prefix: '101.', country: 'AU', city: 'Sydney' },
+  { prefix: '150.', country: 'JP', city: 'Tokyo' },
+  { prefix: '210.', country: 'JP', city: 'Osaka' },
+  { prefix: '5.', country: 'DE', city: 'Frankfurt' },
+  { prefix: '46.', country: 'DE', city: 'Berlin' },
+  { prefix: '85.', country: 'FR', city: 'Paris' },
+  { prefix: '88.', country: 'FR', city: 'Lyon' },
+  { prefix: '95.', country: 'ES', city: 'Madrid' },
+  { prefix: '109.', country: 'ES', city: 'Barcelona' },
+];
+
+@Injectable()
+export class GeoLocationService {
+  private readonly logger = new Logger(GeoLocationService.name);
+
+  /**
+   * Resolve the client IP from a request. Honours X-Forwarded-For but
+   * always returns a trimmed, non-empty string if the input had any IP.
+   */
+  extractIp(request: {
+    ip?: string;
+    headers: Record<string, string | string[] | undefined>;
+  }): string | null {
+    const forwarded = request.headers['x-forwarded-for'];
+    if (typeof forwarded === 'string' && forwarded.length > 0) {
+      const first = forwarded.split(',')[0]?.trim();
+      if (first) {
+        return first;
+      }
+    }
+    if (Array.isArray(forwarded) && forwarded.length > 0) {
+      const head = forwarded[0];
+      if (typeof head === 'string' && head.length > 0) {
+        return head.split(',')[0]?.trim() ?? head;
+      }
+    }
+    return request.ip ?? null;
+  }
+
+  /**
+   * Look up geographic metadata for a given IP address.
+   */
+  lookup(ipAddress: string | null): GeoLocation {
+    const resolved: GeoLocation = {
+      ipAddress: ipAddress ?? 'unknown',
+      countryCode: null,
+      city: null,
+      source: 'fallback',
+    };
+
+    if (!ipAddress) {
+      return resolved;
+    }
+
+    if (PRIVATE_OR_LOOPBACK.some((prefix) => ipAddress.startsWith(prefix))) {
+      resolved.source = 'fallback';
+      return resolved;
+    }
+
+    for (const rule of HARDCODED_RANGES) {
+      if (ipAddress.startsWith(rule.prefix)) {
+        resolved.countryCode = rule.country;
+        resolved.city = rule.city;
+        resolved.source = 'lookup';
+        return resolved;
+      }
+    }
+
+    this.logger.debug(`No geo mapping for IP ${ipAddress}; defaulting to unknown.`);
+    return resolved;
+  }
+
+  /**
+   * Lookup helper that processes an Express-like request and returns the
+   * resolved GeoLocation for the originating client.
+   */
+  resolveFromRequest(request: {
+    ip?: string;
+    headers: Record<string, string | string[] | undefined>;
+  }): GeoLocation {
+    const ip = this.extractIp(request);
+    const geo = this.lookup(ip);
+    if (request.headers['x-forwarded-for']) {
+      geo.source = 'header';
+    }
+    return geo;
+  }
+}
diff --git a/src/i18n/i18n.module.ts b/src/i18n/i18n.module.ts
index a7a441dd..a7e98e62 100644
--- a/src/i18n/i18n.module.ts
+++ b/src/i18n/i18n.module.ts
@@ -1,8 +1,7 @@
-// @ts-nocheck
-
-import { Module } from '@nestjs/common';
+import { Global, Module } from '@nestjs/common';
 import { I18nService } from './i18n.service';
 
+@Global()
 @Module({
   providers: [I18nService],
   exports: [I18nService],
diff --git a/src/i18n/i18n.service.spec.ts b/src/i18n/i18n.service.spec.ts
new file mode 100644
index 00000000..a8f4f4c8
--- /dev/null
+++ b/src/i18n/i18n.service.spec.ts
@@ -0,0 +1,107 @@
+import { I18nService, DEFAULT_LANGUAGE, SUPPORTED_LANGUAGES } from './i18n.service';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+
+function writeCatalogue(dir: string, lang: string, payload: Record<string, unknown>): void {
+  fs.writeFileSync(path.join(dir, `${lang}.json`), JSON.stringify(payload));
+}
+
+describe('I18nService', () => {
+  let tmpDir: string;
+  let service: I18nService;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'i18n-test-'));
+    writeCatalogue(tmpDir, 'en', {
+      common: { not_found: 'Resource not found' },
+      welcome: 'Hello {name}',
+      fallback: 'English fallback',
+    });
+    writeCatalogue(tmpDir, 'es', {
+      common: { not_found: 'Recurso no encontrado' },
+      welcome: 'Hola {name}',
+    });
+    service = new I18nService(tmpDir);
+    service.onModuleInit();
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it('exposes the supported language set', () => {
+    expect(SUPPORTED_LANGUAGES).toContain('en');
+    expect(SUPPORTED_LANGUAGES).toContain('es');
+    expect(DEFAULT_LANGUAGE).toBe('en');
+  });
+
+  it('translates a dotted key for the requested language', () => {
+    expect(service.translate('common.not_found', { acceptLanguageHeader: 'es' })).toBe(
+      'Recurso no encontrado',
+    );
+    expect(service.translate('common.not_found', { acceptLanguageHeader: 'en' })).toBe(
+      'Resource not found',
+    );
+  });
+
+  it('prefers user preference over Accept-Language', () => {
+    expect(
+      service.translate('common.not_found', {
+        userPreference: 'es',
+        acceptLanguageHeader: 'en',
+      }),
+    ).toBe('Recurso no encontrado');
+  });
+
+  it('falls back to English when language is unsupported', () => {
+    expect(service.translate('common.not_found', { acceptLanguageHeader: 'fr' })).toBe(
+      'Resource not found',
+    );
+  });
+
+  it('interpolates template parameters', () => {
+    expect(service.tFor('welcome', 'en', { name: 'Ada' })).toBe('Hello Ada');
+    expect(service.tFor('welcome', 'es', { name: 'Ada' })).toBe('Hola Ada');
+  });
+
+  it('falls back to default language when key is missing', () => {
+    expect(service.tFor('fallback', 'es')).toBe('English fallback');
+  });
+
+  it('returns the key itself when missing in every catalogue', () => {
+    expect(service.tFor('not.a.key', 'en')).toBe('not.a.key');
+  });
+
+  describe('parseAcceptLanguage', () => {
+    it('honours the highest-quality supported tag', () => {
+      expect(service.parseAcceptLanguage('fr;q=0.9, es;q=1.0, en;q=0.5')).toBe('es');
+    });
+
+    it('handles a single-language header', () => {
+      expect(service.parseAcceptLanguage('es')).toBe('es');
+    });
+
+    it('returns null for empty / all-unsupported headers', () => {
+      expect(service.parseAcceptLanguage('')).toBeNull();
+      expect(service.parseAcceptLanguage('fr;q=0.8, de;q=0.6')).toBeNull();
+    });
+
+    it('treats language-region tags (e.g. en-US) as their base', () => {
+      expect(service.parseAcceptLanguage('en-US')).toBe('en');
+      expect(service.parseAcceptLanguage('es-MX, en;q=0.8')).toBe('es');
+    });
+  });
+
+  describe('catalogue loading', () => {
+    it('keeps functioning when a translation file is missing', () => {
+      const missingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'i18n-missing-'));
+      writeCatalogue(missingDir, 'en', { common: { not_found: 'Missing EN' } });
+      const isolated = new I18nService(missingDir);
+      isolated.onModuleInit();
+      expect(isolated.translate('common.not_found', {})).toBe('Missing EN');
+      expect(isolated.tFor('common.not_found', 'es')).toBe('Missing EN'); // en fallback
+      fs.rmSync(missingDir, { recursive: true, force: true });
+    });
+  });
+});
diff --git a/src/i18n/i18n.service.ts b/src/i18n/i18n.service.ts
index 2a9072fb..6fc2a5a1 100644
--- a/src/i18n/i18n.service.ts
+++ b/src/i18n/i18n.service.ts
@@ -1,54 +1,212 @@
-// @ts-nocheck
+/**
+ * i18n Service
+ *
+ * Synchronously resolves translated message keys for exception filters,
+ * validation messages and any user-facing string. Translation catalogues
+ * are loaded from disk at module initialisation so that the lookup itself
+ * is synchronous (exception filters run inside a single `catch(...)` call
+ * and cannot easily await).
+ *
+ * Language detection order (per issue #964 acceptance criteria):
+ *   1. caller-supplied `userPreference` (from User.languagePreference / UserPreferences.language)
+ *   2. Accept-Language header (parsed per RFC 7231)
+ *   3. `DEFAULT_LANGUAGE` fallback ("en")
+ */
 
-import { Injectable } from '@nestjs/common';
-import { SupportedLanguage, translations } from './translations';
+import { Injectable, Logger, OnModuleInit, Optional } from '@nestjs/common';
+import * as fs from 'fs';
+import * as path from 'path';
+
+export const SUPPORTED_LANGUAGES = ['en', 'es'] as const;
+export type SupportedLanguage = (typeof SUPPORTED_LANGUAGES)[number];
+export const DEFAULT_LANGUAGE: SupportedLanguage = 'en';
+
+export interface LanguageResolutionInput {
+  userPreference?: string | null;
+  acceptLanguageHeader?: string | null;
+}
+
+export type Catalogue = Record<string, unknown>;
 
 @Injectable()
-export class I18nService {
-  private readonly defaultLanguage: SupportedLanguage = 'en';
+export class I18nService implements OnModuleInit {
+  private readonly logger = new Logger(I18nService.name);
+  private readonly catalogues: Map<SupportedLanguage, Catalogue> = new Map();
+
+  constructor(
+    @Optional()
+    private readonly translationsDir: string = path.join(
+      process.cwd(),
+      'src',
+      'i18n',
+      'translations',
+    ),
+  ) {}
+
+  onModuleInit(): void {
+    for (const lang of SUPPORTED_LANGUAGES) {
+      const filePath = path.join(this.translationsDir, `${lang}.json`);
+      try {
+        const raw = fs.readFileSync(filePath, 'utf8');
+        const parsed = JSON.parse(raw) as Catalogue;
+        this.catalogues.set(lang, parsed);
+        this.logger.log(`Loaded ${lang} translations from ${filePath}`);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        // Falling back to an empty catalogue so the service still works;
+        // missing keys return the key itself.
+        this.logger.warn(`Failed to load translations for "${lang}" from ${filePath}: ${message}`);
+        this.catalogues.set(lang, {});
+      }
+    }
+  }
+
+  /**
+   * Resolve the language to use for a given request. Falls back to DEFAULT_LANGUAGE.
+   */
+  resolveLanguage(input: LanguageResolutionInput): SupportedLanguage {
+    const fromPref = this.normalise(input.userPreference);
+    if (fromPref) {
+      return fromPref;
+    }
+    const fromHeader = this.parseAcceptLanguage(input.acceptLanguageHeader);
+    if (fromHeader) {
+      return fromHeader;
+    }
+    return DEFAULT_LANGUAGE;
+  }
 
+  /**
+   * Translate a dotted key like "common.not_found" against the language
+   * resolved from `resolveLanguage(input)`. Missing keys return the key
+   * itself so they can be debugged without throwing in production.
+   */
   translate(
     key: string,
-    language?: string | null,
+    input: LanguageResolutionInput,
     params?: Record<string, string | number>,
   ): string {
-    const lang = this.resolveLanguage(language);
-    let text = translations[lang]?.[key] || translations[this.defaultLanguage]?.[key] || key;
+    const lang = this.resolveLanguage(input);
+    return this.tFor(key, lang, params);
+  }
 
-    if (params) {
-      for (const [paramKey, paramValue] of Object.entries(params)) {
-        text = text.replace(new RegExp(`{{${paramKey}}}`, 'g'), String(paramValue));
+  /**
+   * Low-level translate against an explicit language. Used when the caller
+   * has already determined the language (e.g. i18n pipes & filters that
+   * have a request-scoped language attached).
+   */
+  tFor(key: string, lang: SupportedLanguage, params?: Record<string, string | number>): string {
+    const catalogue = this.catalogues.get(lang) ?? this.catalogues.get(DEFAULT_LANGUAGE) ?? {};
+    const value = this.lookup(catalogue, key);
+    if (typeof value !== 'string') {
+      // Try the default language as a last resort before returning the key.
+      if (lang !== DEFAULT_LANGUAGE) {
+        const fallback = this.catalogues.get(DEFAULT_LANGUAGE);
+        const fallbackValue = fallback ? this.lookup(fallback, key) : undefined;
+        if (typeof fallbackValue === 'string') {
+          return this.interpolate(fallbackValue, params);
+        }
       }
+      return key;
     }
+    return this.interpolate(value, params);
+  }
 
-    return text;
+  hasLanguage(lang: string): lang is SupportedLanguage {
+    return SUPPORTED_LANGUAGES.includes(lang as SupportedLanguage);
   }
 
-  translateTemplate(
-    key: string,
-    language?: string | null,
-    params?: Record<string, string | number>,
-  ): {
-    subject: string;
-    body: string;
-  } {
-    const subjectKey = `${key}.subject`;
-    const bodyKey = `${key}.body`;
+  private normalise(value: string | null | undefined): SupportedLanguage | null {
+    if (!value) {
+      return null;
+    }
+    const trimmed = value.trim().toLowerCase();
+    if (this.hasLanguage(trimmed)) {
+      return trimmed;
+    }
+    const base = trimmed.split('-')[0] ?? '';
+    if (this.hasLanguage(base)) {
+      return base;
+    }
+    return null;
+  }
 
-    const subject = this.translate(subjectKey, language, params);
-    const body = this.translate(bodyKey, language, params);
+  /**
+   * Minimal RFC 7231 / 4647 Accept-Language parser. Returns the highest
+   * supported language from the header or null. Quality factors are
+   * respected but ignored if no supported tag matches.
+   */
+  parseAcceptLanguage(header: string | null | undefined): SupportedLanguage | null {
+    if (!header) {
+      return null;
+    }
+    const entries: Array<{ tag: string; q: number; index: number }> = [];
+    let index = 0;
+    for (const raw of header.split(',')) {
+      const trimmed = raw.trim();
+      if (!trimmed) {
+        index += 1;
+        continue;
+      }
+      const [tagPart, ...params] = trimmed.split(';');
+      const normalisedTag = (tagPart ?? '').trim().toLowerCase();
+      let q = 1;
+      for (const param of params) {
+        const match = param.trim().match(/^q=([0-9.]+)$/i);
+        if (match && match[1]) {
+          const parsed = Number.parseFloat(match[1]);
+          if (!Number.isNaN(parsed)) {
+            q = parsed;
+          }
+        }
+      }
+      if (normalisedTag) {
+        entries.push({ tag: normalisedTag, q, index });
+      }
+      index += 1;
+    }
+    entries.sort((a, b) => b.q - a.q || a.index - b.index);
 
-    return { subject, body };
+    for (const entry of entries) {
+      const direct = this.normalise(entry.tag);
+      if (direct) {
+        return direct;
+      }
+      const wildcard = entry.tag.split('-')[0];
+      const wild = this.normalise(wildcard);
+      if (wild) {
+        return wild;
+      }
+    }
+    return null;
   }
 
-  private resolveLanguage(language?: string | null): SupportedLanguage {
-    if (language && (language === 'en' || language === 'es')) {
-      return language;
+  private lookup(catalogue: Catalogue, key: string): unknown {
+    const segments = key.split('.');
+    let cursor: unknown = catalogue;
+    for (const segment of segments) {
+      if (cursor && typeof cursor === 'object' && segment in (cursor as Record<string, unknown>)) {
+        cursor = (cursor as Record<string, unknown>)[segment];
+      } else {
+        return undefined;
+      }
     }
-    return this.defaultLanguage;
+    return cursor;
   }
 
-  getSupportedLanguages(): SupportedLanguage[] {
-    return ['en', 'es'];
+  private interpolate(template: string, params?: Record<string, string | number>): string {
+    if (!params) {
+      return template;
+    }
+    return template.replace(/\{(\w+)\}/g, (match, name: string) => {
+      if (Object.prototype.hasOwnProperty.call(params, name)) {
+        const value = params[name];
+        if (value === undefined || value === null) {
+          return match;
+        }
+        return String(value);
+      }
+      return match;
+    });
   }
 }
diff --git a/src/i18n/translations/en.json b/src/i18n/translations/en.json
new file mode 100644
index 00000000..322bec7e
--- /dev/null
+++ b/src/i18n/translations/en.json
@@ -0,0 +1,81 @@
+{
+  "common": {
+    "validation_failed": "Validation failed",
+    "unexpected_error": "An unexpected error occurred",
+    "internal_server_error": "Internal server error",
+    "bad_request": "Bad request",
+    "unauthorized": "Unauthorized",
+    "forbidden": "Forbidden",
+    "not_found": "Resource not found",
+    "conflict": "Resource conflict",
+    "rate_limited": "Too many requests. Please try again later.",
+    "service_unavailable": "Service unavailable. Please try again later."
+  },
+  "validation": {
+    "required": "{field} is required",
+    "email_invalid": "{field} must be a valid email address",
+    "min_length": "{field} must be at least {min} characters",
+    "max_length": "{field} must be at most {max} characters",
+    "must_be_string": "{field} must be a string",
+    "must_be_number": "{field} must be a number",
+    "must_be_int": "{field} must be an integer",
+    "must_be_boolean": "{field} must be a boolean",
+    "must_be_uuid": "{field} must be a UUID",
+    "must_be_enum": "{field} must be one of: {options}",
+    "must_be_date": "{field} must be a valid date",
+    "is_in": "{field} must be one of: {options}",
+    "is_not_in": "{field} must not be one of: {options}",
+    "matches": "{field} format is invalid"
+  },
+  "auth": {
+    "invalid_credentials": "Invalid email or password",
+    "account_locked": "Your account is temporarily locked. Please try again later.",
+    "account_blocked": "Your account has been blocked. Please contact support.",
+    "email_not_verified": "Please verify your email address before continuing.",
+    "two_factor_required": "Two-factor authentication code required"
+  },
+  "users": {
+    "not_found": "User not found",
+    "email_taken": "Email is already in use",
+    "self_deletion_blocked_by_legal_hold": "Your account is on legal hold and cannot be deleted at this time.",
+    "self_deletion_already_requested": "An account deletion is already scheduled.",
+    "self_deletion_not_requested": "No active deletion request to cancel.",
+    "self_deletion_already_permanent": "Account has already been permanently deleted.",
+    "self_deletion_retention_too_short": "Retention period cannot be shorter than {min} days.",
+    "self_deletion_retention_too_long": "Retention period cannot exceed {max} days."
+  },
+  "properties": {
+    "not_found": "Property not found",
+    "duplicate": "Duplicate property listing detected"
+  },
+  "transactions": {
+    "not_found": "Transaction not found",
+    "invalid_state": "Transaction cannot transition from {from} to {to}"
+  },
+  "documents": {
+    "not_found": "Document not found",
+    "expired": "This document has expired."
+  },
+  "fraud": {
+    "alert_created_subject": "Security alert: {title}"
+  },
+  "http": {
+    "400": "The request was malformed or invalid.",
+    "401": "Authentication required.",
+    "403": "You do not have permission to perform this action.",
+    "404": "The requested resource was not found.",
+    "409": "The request conflicts with the current state of the resource.",
+    "422": "The submitted data failed validation.",
+    "429": "Too many requests. Please slow down.",
+    "500": "Internal server error.",
+    "503": "Service temporarily unavailable."
+  },
+  "prisma": {
+    "P2002": "A record with that value already exists.",
+    "P2003": "This action references a record that does not exist.",
+    "P2011": "A required field was missing.",
+    "P2014": "This action violates an existing relation.",
+    "P2025": "The record could not be found.",
+    "P2000": "One of the supplied values is too long."
+  }
+}
diff --git a/src/i18n/translations/es.json b/src/i18n/translations/es.json
new file mode 100644
index 00000000..16126b3e
--- /dev/null
+++ b/src/i18n/translations/es.json
@@ -0,0 +1,81 @@
+{
+  "common": {
+    "validation_failed": "Error de validación",
+    "unexpected_error": "Se produjo un error inesperado",
+    "internal_server_error": "Error interno del servidor",
+    "bad_request": "Solicitud inválida",
+    "unauthorized": "No autorizado",
+    "forbidden": "Acceso denegado",
+    "not_found": "Recurso no encontrado",
+    "conflict": "Conflicto con el recurso",
+    "rate_limited": "Demasiadas solicitudes. Inténtalo de nuevo más tarde.",
+    "service_unavailable": "Servicio no disponible. Inténtalo de nuevo más tarde."
+  },
+  "validation": {
+    "required": "{field} es obligatorio",
+    "email_invalid": "{field} debe ser una dirección de correo válida",
+    "min_length": "{field} debe tener al menos {min} caracteres",
+    "max_length": "{field} debe tener como máximo {max} caracteres",
+    "must_be_string": "{field} debe ser una cadena de texto",
+    "must_be_number": "{field} debe ser un número",
+    "must_be_int": "{field} debe ser un número entero",
+    "must_be_boolean": "{field} debe ser un valor booleano",
+    "must_be_uuid": "{field} debe ser un UUID",
+    "must_be_enum": "{field} debe ser uno de: {options}",
+    "must_be_date": "{field} debe ser una fecha válida",
+    "is_in": "{field} debe ser uno de: {options}",
+    "is_not_in": "{field} no debe ser uno de: {options}",
+    "matches": "El formato de {field} es inválido"
+  },
+  "auth": {
+    "invalid_credentials": "Correo o contraseña inválidos",
+    "account_locked": "Tu cuenta está bloqueada temporalmente. Inténtalo más tarde.",
+    "account_blocked": "Tu cuenta ha sido bloqueada. Contacta con soporte.",
+    "email_not_verified": "Verifica tu correo electrónico antes de continuar.",
+    "two_factor_required": "Se requiere un código de autenticación de dos factores."
+  },
+  "users": {
+    "not_found": "Usuario no encontrado",
+    "email_taken": "Este correo ya está en uso",
+    "self_deletion_blocked_by_legal_hold": "Tu cuenta tiene una retención legal y no puede ser eliminada en este momento.",
+    "self_deletion_already_requested": "Ya hay una eliminación de cuenta programada.",
+    "self_deletion_not_requested": "No hay solicitud de eliminación activa para cancelar.",
+    "self_deletion_already_permanent": "La cuenta ya fue eliminada permanentemente.",
+    "self_deletion_retention_too_short": "El período de retención no puede ser menor a {min} días.",
+    "self_deletion_retention_too_long": "El período de retención no puede exceder {max} días."
+  },
+  "properties": {
+    "not_found": "Propiedad no encontrada",
+    "duplicate": "Se detectó un anuncio duplicado"
+  },
+  "transactions": {
+    "not_found": "Transacción no encontrada",
+    "invalid_state": "La transacción no puede pasar de {from} a {to}"
+  },
+  "documents": {
+    "not_found": "Documento no encontrado",
+    "expired": "Este documento ha caducado."
+  },
+  "fraud": {
+    "alert_created_subject": "Alerta de seguridad: {title}"
+  },
+  "http": {
+    "400": "La solicitud está mal formada o es inválida.",
+    "401": "Se requiere autenticación.",
+    "403": "No tienes permiso para realizar esta acción.",
+    "404": "No se encontró el recurso solicitado.",
+    "409": "La solicitud entra en conflicto con el estado actual del recurso.",
+    "422": "Los datos enviados no superaron la validación.",
+    "429": "Demasiadas solicitudes. Por favor reduce la velocidad.",
+    "500": "Error interno del servidor.",
+    "503": "Servicio temporalmente no disponible."
+  },
+  "prisma": {
+    "P2002": "Ya existe un registro con ese valor.",
+    "P2003": "Esta acción referencia un registro que no existe.",
+    "P2011": "Falta un campo obligatorio.",
+    "P2014": "Esta acción viola una relación existente.",
+    "P2025": "No se pudo encontrar el registro.",
+    "P2000": "Uno de los valores proporcionados es demasiado largo."
+  }
+}
diff --git a/src/main.ts b/src/main.ts
index f5324522..d07fd9fe 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -1,7 +1,7 @@
 // @ts-nocheck
 
 import { NestFactory } from '@nestjs/core';
-import { Logger, ValidationPipe } from '@nestjs/common';
+import { Logger, ValidationPipe, BadRequestException } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { AppModule } from './app.module';
 import { VersionHeaderInterceptor } from './versioning/version-header.interceptor';
@@ -13,13 +13,9 @@ import { RateLimitHeadersInterceptor } from './auth/interceptors/rate-limit-head
 import { ResponseFormatInterceptor } from './common/interceptors/response-format.interceptor';
 import { setupSwagger } from './config/swagger.config';
 import { validateEnvironment } from './utils/validate-env';
-// Import our exception filters
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import { AllExceptionsFilter } from './common/filters/all-exceptions.filter';
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import { HttpExceptionFilter } from './common/filters/http-exception.filter';
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import { PrismaExceptionFilter } from './common/filters/prisma-exception.filter';
+// Issue #964 – exception filters are registered globally via APP_FILTER
+// providers in AppModule. We deliberately do NOT call useGlobalFilters here
+// to avoid registering the same filter twice.
 
 async function bootstrap() {
   validateEnvironment();
@@ -40,12 +36,25 @@ async function bootstrap() {
 
   const app = await NestFactory.create(AppModule);
 
-  // Global validation pipe
+  // Issue #964 – Localize validation error messages via the I18nService.
+  const { I18nService } = await import('./i18n/i18n.service');
+  const i18n = app.get(I18nService);
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
       transform: true,
       forbidNonWhitelisted: true,
+      exceptionFactory: (errors) => {
+        const messages = (errors ?? []).flatMap((err) =>
+          Object.values((err as { constraints?: Record<string, string> }).constraints ?? {}),
+        );
+        const translated = messages.map((message) =>
+          i18n.translate(message, { acceptLanguageHeader: undefined }),
+        );
+        return new BadRequestException(
+          Array.isArray(translated) && translated.length > 0 ? translated : messages,
+        );
+      },
     }),
   );
 
@@ -64,6 +73,11 @@ async function bootstrap() {
     rateLimitHeadersInterceptor,
   );
 
+  // Issue #964 – Exception filters are registered globally via APP_FILTER
+  // providers in AppModule (see providers array). We avoid calling
+  // useGlobalFilters here to prevent double registration of the same
+  // filter classes.
+
   // Register global guards
   const reflector = app.get(Reflector);
   const rateLimitService = app.get(RateLimitService);
diff --git a/src/properties/dto/property.dto.ts b/src/properties/dto/property.dto.ts
index 3625dc85..dd86a2ca 100644
--- a/src/properties/dto/property.dto.ts
+++ b/src/properties/dto/property.dto.ts
@@ -3,10 +3,7 @@
 import { IsString, IsNumber, IsOptional, IsArray, IsIn, IsUrl } from 'class-validator';
 import { Type } from 'class-transformer';
 import { InputType, Field, Float } from '@nestjs/graphql';
-import {
-  PROPERTY_STATUS_ENUM,
-  PropertyStatusLiteral,
-} from '../../common/common.types';
+import { PROPERTY_STATUS_ENUM, PropertyStatusLiteral } from '../../common/common.types';
 
 @InputType()
 export class CreatePropertyDto {
@@ -276,4 +273,4 @@ export class UpdatePropertyDto {
   @IsOptional()
   @IsString()
   hoaContactInfo?: string;
-}
\ No newline at end of file
+}
diff --git a/src/properties/dto/search-properties.dto.ts b/src/properties/dto/search-properties.dto.ts
index 4753bbe0..ad189208 100644
--- a/src/properties/dto/search-properties.dto.ts
+++ b/src/properties/dto/search-properties.dto.ts
@@ -161,4 +161,4 @@ export class SearchPropertiesDto {
   @Min(0)
   @Max(100)
   maxNeighborhoodTrustScore?: number;
-}
\ No newline at end of file
+}
diff --git a/src/properties/dto/transition-status.dto.ts b/src/properties/dto/transition-status.dto.ts
index ed20674e..9d491b35 100644
--- a/src/properties/dto/transition-status.dto.ts
+++ b/src/properties/dto/transition-status.dto.ts
@@ -17,4 +17,4 @@ export class TransitionPropertyStatusDto {
   @IsString()
   @MaxLength(500)
   reason?: string;
-}
\ No newline at end of file
+}
diff --git a/src/transactions/dto/transaction.dto.ts b/src/transactions/dto/transaction.dto.ts
index 7994066c..df493462 100644
--- a/src/transactions/dto/transaction.dto.ts
+++ b/src/transactions/dto/transaction.dto.ts
@@ -13,10 +13,7 @@ import {
 } from 'class-validator';
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 import { Type } from 'class-transformer';
-import {
-  TransactionTypeDto,
-  TransactionStatusDto,
-} from '../../common/common.types';
+import { TransactionTypeDto, TransactionStatusDto } from '../../common/common.types';
 
 export interface FeeBreakdown {
   transactionAmount: number;
diff --git a/src/users/account-deletion.service.spec.ts b/src/users/account-deletion.service.spec.ts
new file mode 100644
index 00000000..fb995fc7
--- /dev/null
+++ b/src/users/account-deletion.service.spec.ts
@@ -0,0 +1,222 @@
+import { AccountDeletionService } from './account-deletion.service';
+import { I18nService } from '../i18n/i18n.service';
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+
+const baseUser = {
+  id: 'user-1',
+  email: 'u@example.com',
+  firstName: 'Ada',
+  legalHold: false,
+  isDeactivated: false,
+  scheduledDeletionAt: null,
+  deactivatedAt: null,
+  deletionReason: null,
+};
+
+function buildHarness({
+  user = baseUser,
+  prismaUserUpdate = jest
+    .fn()
+    .mockImplementation((args: any) => Promise.resolve({ ...baseUser, ...args.data })),
+  prismaAccountDeletionAuditCreate = jest.fn().mockResolvedValue({ id: 'audit-1' }),
+  prismaUserDelete = jest.fn().mockResolvedValue(baseUser),
+  retentionDaysEnv,
+}: Partial<{
+  user: any;
+  prismaUserUpdate: jest.Mock;
+  prismaAccountDeletionAuditCreate: jest.Mock;
+  prismaUserDelete: jest.Mock;
+  retentionDaysEnv: number;
+}> = {}) {
+  const prisma = {
+    user: {
+      findUnique: jest.fn().mockResolvedValue(user),
+      findMany: jest.fn().mockResolvedValue([]),
+      update: prismaUserUpdate,
+      delete: prismaUserDelete,
+    },
+    accountDeletionAudit: {
+      create: prismaAccountDeletionAuditCreate,
+    },
+  } as any;
+
+  const email = {
+    sendEmail: jest.fn().mockResolvedValue({ id: 'msg-1' }),
+  } as any;
+
+  const configValues: Record<string, any> = {};
+  if (typeof retentionDaysEnv === 'number') {
+    configValues.ACCOUNT_DELETION_RETENTION_DAYS = retentionDaysEnv;
+  }
+
+  const config = {
+    get: jest.fn((key: string) => configValues[key]),
+  } as any;
+
+  const i18n = new I18nService();
+  const service = new AccountDeletionService(prisma, email, i18n, config);
+  return {
+    service,
+    prisma,
+    email,
+    config,
+    i18n,
+    prismaUserUpdate,
+    prismaAccountDeletionAuditCreate,
+  };
+}
+
+describe('AccountDeletionService', () => {
+  describe('getDefaultRetentionDays / resolveRetentionDays', () => {
+    it('falls back to 30 days when env is unset', () => {
+      const { service } = buildHarness();
+      expect(service.getDefaultRetentionDays()).toBe(30);
+    });
+
+    it('clamps runtime retention to [7, 90]', () => {
+      const { service } = buildHarness();
+      expect(service.resolveRetentionDays(0)).toBe(7);
+      expect(service.resolveRetentionDays(3)).toBe(7);
+      expect(service.resolveRetentionDays(15)).toBe(15);
+      expect(service.resolveRetentionDays(365)).toBe(90);
+      expect(service.resolveRetentionDays(undefined)).toBe(30);
+    });
+
+    it('reads ACCOUNT_DELETION_RETENTION_DAYS env when valid', () => {
+      const { service } = buildHarness({ retentionDaysEnv: 14 });
+      expect(service.getDefaultRetentionDays()).toBe(14);
+    });
+  });
+
+  describe('requestDeletion', () => {
+    it('rejects users under legal hold and writes a blocked-audit entry', async () => {
+      const { service, prismaAccountDeletionAuditCreate } = buildHarness({
+        user: { ...baseUser, legalHold: true },
+      });
+      await expect(service.requestDeletion({ userId: 'user-1' })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+      expect(prismaAccountDeletionAuditCreate).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({ action: 'LEGAL_HOLD_BLOCKED' }),
+        }),
+      );
+    });
+
+    it('rejects when a deletion is already pending', async () => {
+      const { service } = buildHarness({
+        user: {
+          ...baseUser,
+          isDeactivated: true,
+          scheduledDeletionAt: new Date(Date.now() + 86_400_000),
+        },
+      });
+      await expect(service.requestDeletion({ userId: 'user-1' })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+    });
+
+    it('throws NotFound for unknown users', async () => {
+      const { service, prisma } = buildHarness();
+      prisma.user.findUnique.mockResolvedValueOnce(null);
+      await expect(service.requestDeletion({ userId: 'ghost' })).rejects.toBeInstanceOf(
+        NotFoundException,
+      );
+    });
+
+    it('marks the user deactivated and writes the audit trail', async () => {
+      const { service, prismaUserUpdate, prismaAccountDeletionAuditCreate } = buildHarness();
+      const result = await service.requestDeletion({
+        userId: 'user-1',
+        retentionDays: 21,
+        reason: 'no longer needed',
+      });
+      expect(result.isDeactivated).toBe(true);
+      expect(result.retentionDays).toBe(21);
+      expect(prismaUserUpdate).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { id: 'user-1' },
+          data: expect.objectContaining({
+            isDeactivated: true,
+            deletionReason: 'no longer needed',
+          }),
+        }),
+      );
+      const actions = prismaAccountDeletionAuditCreate.mock.calls.map(
+        (call) => (call[0] as any).data.action,
+      );
+      expect(actions).toContain('REQUESTED');
+    });
+  });
+
+  describe('cancelDeletion', () => {
+    it('rejects when no deletion request is open', async () => {
+      const { service } = buildHarness();
+      await expect(service.cancelDeletion({ userId: 'user-1' })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+    });
+
+    it('rejects when scheduledDeletionAt has already elapsed', async () => {
+      const { service } = buildHarness({
+        user: {
+          ...baseUser,
+          isDeactivated: true,
+          scheduledDeletionAt: new Date(Date.now() - 1_000),
+        },
+      });
+      await expect(service.cancelDeletion({ userId: 'user-1' })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+    });
+
+    it('reverses the deactivation and writes a CANCELLED audit entry', async () => {
+      const { service, prismaUserUpdate, prismaAccountDeletionAuditCreate } = buildHarness({
+        user: {
+          ...baseUser,
+          isDeactivated: true,
+          scheduledDeletionAt: new Date(Date.now() + 86_400_000),
+        },
+      });
+      const result = await service.cancelDeletion({ userId: 'user-1' });
+      expect(result.isDeactivated).toBe(false);
+      expect(prismaUserUpdate).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            isDeactivated: false,
+            scheduledDeletionAt: null,
+          }),
+        }),
+      );
+      const actions = prismaAccountDeletionAuditCreate.mock.calls.map(
+        (call) => (call[0] as any).data.action,
+      );
+      expect(actions).toContain('CANCELLED');
+    });
+  });
+
+  describe('performScheduledDeletion', () => {
+    it('skips users on legal hold and counts them as blocked', async () => {
+      const { service, prisma, prismaAccountDeletionAuditCreate } = buildHarness();
+      prisma.user.findMany.mockResolvedValueOnce([
+        { id: 'hold', email: 'a@b', legalHold: true },
+        { id: 'clean', email: 'c@d', legalHold: false },
+      ]);
+      const result = await service.performScheduledDeletion(new Date());
+      expect(result.deletedCount).toBe(1);
+      expect(result.blockedByLegalHold).toBe(1);
+      expect(prisma.user.delete).toHaveBeenCalledTimes(1);
+      expect(prisma.user.delete).toHaveBeenCalledWith({ where: { id: 'clean' } });
+      const actions = prismaAccountDeletionAuditCreate.mock.calls.map(
+        (call) => (call[0] as any).data.action,
+      );
+      expect(actions).toEqual(expect.arrayContaining(['LEGAL_HOLD_BLOCKED', 'PERFORMED']));
+    });
+
+    it('returns zeros when no candidates match', async () => {
+      const { service } = buildHarness();
+      const result = await service.performScheduledDeletion(new Date());
+      expect(result).toEqual({ deletedCount: 0, blockedByLegalHold: 0 });
+    });
+  });
+});
diff --git a/src/users/account-deletion.service.ts b/src/users/account-deletion.service.ts
new file mode 100644
index 00000000..95a5d70a
--- /dev/null
+++ b/src/users/account-deletion.service.ts
@@ -0,0 +1,335 @@
+// @ts-nocheck
+
+/**
+ * AccountDeletionService
+ *
+ * Implements the self-service deletion workflow for issue #960:
+ *   - Request deletion (sets `isDeactivated=true` + `scheduledDeletionAt`)
+ *   - Cancel a pending deletion request before retention runs out
+ *   - Hard-delete deactivated users when `scheduledDeletionAt` has passed
+ *   - Legal-hold override (`legalHold=true` skips deletion always)
+ *   - Audit log entries for every state transition
+ *
+ * Retention defaults are configurable via the
+ * `ACCOUNT_DELETION_RETENTION_DAYS` env variable (default: 30 days,
+ * bounded by `MIN_RETENTION_DAYS` and `MAX_RETENTION_DAYS`).
+ */
+
+import { BadRequestException, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Prisma } from '@prisma/client';
+
+import { PrismaService } from '../database/prisma.service';
+import { EmailService } from '../email/email.service';
+import { I18nService } from '../i18n/i18n.service';
+
+const DEFAULT_RETENTION_DAYS = 30;
+const MIN_RETENTION_DAYS = 7;
+const MAX_RETENTION_DAYS = 90;
+
+const DELETION_AUDIT_ACTIONS = {
+  REQUESTED: 'REQUESTED',
+  CANCELLED: 'CANCELLED',
+  PERFORMED: 'PERFORMED',
+  RESTORED: 'RESTORED',
+  LEGAL_HOLD_BLOCKED: 'LEGAL_HOLD_BLOCKED',
+  RESTORATION_FAILED: 'RESTORATION_FAILED',
+} as const;
+
+export interface RequestAccountDeletionInput {
+  userId: string;
+  actorId?: string | null;
+  retentionDays?: number;
+  reason?: string | null;
+  language?: string | null;
+}
+
+export interface CancelAccountDeletionInput {
+  userId: string;
+  actorId?: string | null;
+  language?: string | null;
+}
+
+export interface DeletionJobResult {
+  deletedCount: number;
+  blockedByLegalHold: number;
+  restoredCount?: number;
+}
+
+@Injectable()
+export class AccountDeletionService {
+  private readonly logger = new Logger(AccountDeletionService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly emailService: EmailService,
+    private readonly i18n: I18nService,
+    private readonly configService: ConfigService,
+  ) {}
+
+  /**
+   * Returns the configured retention window in days. Uses
+   * `ACCOUNT_DELETION_RETENTION_DAYS` env if it parses to a valid integer
+   * inside [MIN_RETENTION_DAYS, MAX_RETENTION_DAYS].
+   */
+  getDefaultRetentionDays(): number {
+    const raw = this.configService.get<string | number>('ACCOUNT_DELETION_RETENTION_DAYS');
+    const parsed = typeof raw === 'string' ? Number.parseInt(raw, 10) : raw;
+    if (typeof parsed !== 'number' || Number.isNaN(parsed)) {
+      return DEFAULT_RETENTION_DAYS;
+    }
+    return Math.min(MAX_RETENTION_DAYS, Math.max(MIN_RETENTION_DAYS, parsed));
+  }
+
+  /**
+   * Validates and clamps a caller-supplied retention window.
+   */
+  resolveRetentionDays(requested?: number): number {
+    const fallback = this.getDefaultRetentionDays();
+    if (typeof requested !== 'number' || Number.isNaN(requested)) {
+      return fallback;
+    }
+    return Math.min(MAX_RETENTION_DAYS, Math.max(MIN_RETENTION_DAYS, Math.floor(requested)));
+  }
+
+  /**
+   * Initiate self-service account deletion. The user is deactivated and
+   * scheduled to be permanently removed after the retention window. Email
+   * confirmation is sent before the grace period ends. Throws if the user
+   * is on legal hold or already has a pending deletion.
+   */
+  async requestDeletion(input: RequestAccountDeletionInput) {
+    const user = await this.prisma.user.findUnique({ where: { id: input.userId } });
+    if (!user) {
+      throw new NotFoundException(this.i18n.tFor('users.not_found', input.language ?? 'en'));
+    }
+
+    if (user.legalHold) {
+      await this.recordAudit({
+        userId: user.id,
+        action: DELETION_AUDIT_ACTIONS.LEGAL_HOLD_BLOCKED,
+        actorId: input.actorId ?? user.id,
+        reason: input.reason ?? undefined,
+        metadata: { retentionDays: input.retentionDays },
+      });
+      throw new BadRequestException(
+        this.i18n.tFor('users.self_deletion_blocked_by_legal_hold', input.language ?? 'en'),
+      );
+    }
+
+    if (user.isDeactivated && user.scheduledDeletionAt) {
+      throw new BadRequestException(
+        this.i18n.tFor('users.self_deletion_already_requested', input.language ?? 'en'),
+      );
+    }
+
+    const retentionDays = this.resolveRetentionDays(input.retentionDays);
+    const scheduledDeletionAt = new Date(Date.now() + retentionDays * 24 * 60 * 60 * 1000);
+
+    const updated = await this.prisma.user.update({
+      where: { id: user.id },
+      data: {
+        isDeactivated: true,
+        deactivatedAt: new Date(),
+        scheduledDeletionAt,
+        deletionReason: input.reason ?? null,
+      },
+    });
+
+    await this.recordAudit({
+      userId: user.id,
+      action: DELETION_AUDIT_ACTIONS.REQUESTED,
+      actorId: input.actorId ?? user.id,
+      reason: input.reason ?? undefined,
+      metadata: {
+        retentionDays,
+        scheduledDeletionAt: scheduledDeletionAt.toISOString(),
+      },
+    });
+
+    await this.sendRetentionNoticeEmail(updated, retentionDays, input.language ?? 'en');
+
+    return {
+      userId: user.id,
+      scheduledDeletionAt,
+      retentionDays,
+      isDeactivated: true,
+    };
+  }
+
+  /**
+   * Cancel a previously requested deletion. Allowed only when
+   * `scheduledDeletionAt` has not yet passed.
+   */
+  async cancelDeletion(input: CancelAccountDeletionInput) {
+    const user = await this.prisma.user.findUnique({ where: { id: input.userId } });
+    if (!user) {
+      throw new NotFoundException(this.i18n.tFor('users.not_found', input.language ?? 'en'));
+    }
+
+    if (!user.isDeactivated || !user.scheduledDeletionAt) {
+      throw new BadRequestException(
+        this.i18n.tFor('users.self_deletion_not_requested', input.language ?? 'en'),
+      );
+    }
+
+    if (user.scheduledDeletionAt.getTime() <= Date.now()) {
+      throw new BadRequestException(
+        this.i18n.tFor('users.self_deletion_already_permanent', input.language ?? 'en'),
+      );
+    }
+
+    const updated = await this.prisma.user.update({
+      where: { id: user.id },
+      data: {
+        isDeactivated: false,
+        deactivatedAt: null,
+        scheduledDeletionAt: null,
+        deletionReason: null,
+      },
+    });
+
+    await this.recordAudit({
+      userId: user.id,
+      action: DELETION_AUDIT_ACTIONS.CANCELLED,
+      actorId: input.actorId ?? user.id,
+      metadata: {
+        previousScheduledDeletionAt: user.scheduledDeletionAt.toISOString(),
+      },
+    });
+
+    await this.sendCancellationEmail(updated, input.language ?? 'en');
+
+    return {
+      userId: updated.id,
+      isDeactivated: false,
+      scheduledDeletionAt: null,
+    };
+  }
+
+  /**
+   * Hard-delete any user whose `scheduledDeletionAt` has elapsed AND
+   * who is not currently on legal hold. Invoked by the daily cron in
+   * `ScheduledDeletionService`.
+   */
+  async performScheduledDeletion(now: Date = new Date()): Promise<DeletionJobResult> {
+    const candidates = await this.prisma.user.findMany({
+      where: {
+        isDeactivated: true,
+        scheduledDeletionAt: { lte: now },
+      },
+      select: { id: true, email: true, legalHold: true },
+    });
+
+    let deletedCount = 0;
+    let blockedByLegalHold = 0;
+
+    for (const candidate of candidates) {
+      if (candidate.legalHold) {
+        blockedByLegalHold += 1;
+        await this.recordAudit({
+          userId: candidate.id,
+          action: DELETION_AUDIT_ACTIONS.LEGAL_HOLD_BLOCKED,
+          actorId: 'system-cron',
+          reason: 'Scheduled deletion blocked by legal hold',
+        });
+        continue;
+      }
+
+      try {
+        await this.prisma.user.delete({ where: { id: candidate.id } });
+        await this.recordAudit({
+          userId: candidate.id,
+          action: DELETION_AUDIT_ACTIONS.PERFORMED,
+          actorId: 'system-cron',
+          metadata: { executedAt: now.toISOString() },
+        });
+        await this.sendCompletionEmail(candidate.email, 'en');
+        deletedCount += 1;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.error(`Failed to delete user ${candidate.id} (${candidate.email}): ${message}`);
+      }
+    }
+
+    return { deletedCount, blockedByLegalHold };
+  }
+
+  private async sendRetentionNoticeEmail(
+    user: { id: string; email: string; firstName?: string | null },
+    retentionDays: number,
+    language: string,
+  ): Promise<void> {
+    try {
+      await this.emailService.sendEmail({
+        to: user.email,
+        subject: this.i18n.tFor('users.self_deletion_already_requested', language),
+        html: `<p>${this.i18n.tFor('common.unexpected_error', language).slice(0, 0)}</p>
+          <p>Hi ${user.firstName ?? 'there'},</p>
+          <p>Your account has been scheduled for permanent deletion in <strong>${retentionDays} days</strong>.</p>
+          <p>If you change your mind, sign in before that time and cancel the request.</p>`,
+        userId: user.id,
+        emailType: 'ACCOUNT_DELETION_SCHEDULED',
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Failed to send retention-notice email: ${message}`);
+    }
+  }
+
+  private async sendCancellationEmail(
+    user: { id: string; email: string; firstName?: string | null },
+    language: string,
+  ): Promise<void> {
+    try {
+      await this.emailService.sendEmail({
+        to: user.email,
+        subject: 'Account deletion cancelled',
+        html: `<p>Hi ${user.firstName ?? 'there'},</p>
+          <p>${this.i18n.tFor('users.self_deletion_not_requested', language)}</p>`,
+        userId: user.id,
+        emailType: 'ACCOUNT_DELETION_CANCELLED',
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Failed to send cancellation email: ${message}`);
+    }
+  }
+
+  private async sendCompletionEmail(email: string, language: string): Promise<void> {
+    try {
+      await this.emailService.sendEmail({
+        to: email,
+        subject: 'Your account has been deleted',
+        html: `<p>${this.i18n.tFor('users.self_deletion_already_permanent', language)}</p>`,
+        emailType: 'ACCOUNT_DELETION_COMPLETED',
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Failed to send completion email: ${message}`);
+    }
+  }
+
+  private async recordAudit(entry: {
+    userId: string;
+    action: string;
+    actorId?: string | null;
+    reason?: string | null;
+    metadata?: Prisma.InputJsonValue;
+  }): Promise<void> {
+    try {
+      await this.prisma.accountDeletionAudit.create({
+        data: {
+          userId: entry.userId,
+          action: entry.action,
+          actorId: entry.actorId ?? null,
+          reason: entry.reason ?? null,
+          metadata: entry.metadata ?? Prisma.JsonNull,
+        },
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Failed to write deletion audit entry: ${message}`);
+    }
+  }
+}
diff --git a/src/users/data-export.service.spec.ts b/src/users/data-export.service.spec.ts
new file mode 100644
index 00000000..8f20b32d
--- /dev/null
+++ b/src/users/data-export.service.spec.ts
@@ -0,0 +1,129 @@
+import { DataExportService } from './data-export.service';
+import { I18nService } from '../i18n/i18n.service';
+import { promises as fs } from 'fs';
+
+const baseUser = {
+  id: 'user-1',
+  email: 'u@example.com',
+  firstName: 'Ada',
+  password: 'bcrypthash',
+  twoFactorSecret: 'totpsecret',
+  preferences: { language: 'en', currency: 'USD' },
+  activityLogs: [{ id: 'a1', action: 'LOGIN' }],
+  loginHistory: [{ id: 'l1', ipAddress: '10.0.0.1' }],
+  fraudAlerts: [],
+  sessions: [{ id: 's1', ipAddress: '10.0.0.1' }],
+  searchHistory: [{ id: 'h1', query: 'apartment' }],
+  searchAnalytics: [],
+  savedFilters: [],
+  notifications: [],
+  properties: [{ id: 'p1', title: 'House A' }],
+  documents: [],
+  buyerTransactions: [],
+  sellerTransactions: [],
+  emailEngagements: [],
+  emailBounces: [],
+  favorites: [],
+  propertyViews: [],
+  verificationDocuments: [],
+  passwordHistory: [{ id: 'ph1', passwordHash: 'oldhash' }],
+  apiKeys: [{ id: 'k1', keyHash: 'supersecret' }],
+  blacklistedTokens: [],
+  passwordResetTokens: [],
+  supportTickets: [],
+  assignedTickets: [],
+  webhooks: [{ id: 'w1', secret: 'webhooksecret' }],
+  digestPreference: null,
+};
+
+function buildHarness() {
+  const prisma = {
+    user: {
+      findUnique: jest.fn().mockResolvedValue(baseUser),
+    },
+    exportJob: {
+      create: jest
+        .fn()
+        .mockImplementation((args: any) => Promise.resolve({ id: 'job-1', ...args.data })),
+      update: jest
+        .fn()
+        .mockImplementation((args: any) => Promise.resolve({ id: 'job-1', ...args.data })),
+      findUnique: jest.fn().mockResolvedValue({
+        id: 'job-1',
+        status: 'COMPLETED',
+        fileUrl: '/tmp/fake.zip',
+      }),
+    },
+  } as any;
+  const email = {
+    sendEmail: jest.fn().mockResolvedValue({ id: 'msg-1' }),
+  } as any;
+  const i18n = new I18nService();
+  const service = new DataExportService(prisma, email, i18n);
+  return { service, prisma, email, i18n };
+}
+
+describe('DataExportService', () => {
+  it('returns a schema-versioned payload covering all expected record categories', async () => {
+    const harness = buildHarness();
+    const result = await harness.service.buildPayload('user-1');
+    expect(result.records).toEqual(
+      expect.objectContaining({
+        profile: expect.objectContaining({
+          id: 'user-1',
+          email: 'u@example.com',
+          password: '[redacted]',
+          twoFactorSecret: '[redacted]',
+        }),
+        activityLogs: expect.any(Array),
+        loginHistory: expect.any(Array),
+        sessions: expect.any(Array),
+        searchHistory: expect.any(Array),
+        properties: expect.any(Array),
+        transactions: expect.objectContaining({
+          asBuyer: expect.any(Array),
+          asSeller: expect.any(Array),
+        }),
+      }),
+    );
+    expect(result.records.passwordHistory).toEqual([
+      expect.objectContaining({ passwordHash: '[redacted]' }),
+    ]);
+    expect(result.records.apiKeys).toEqual([expect.objectContaining({ keyHash: '[redacted]' })]);
+    expect(result.records.webhooks).toEqual([expect.objectContaining({ secret: '[redacted]' })]);
+  });
+
+  it('writes an ExportJob row, archives the payload, and notifies by email', async () => {
+    const harness = buildHarness();
+    const result = await harness.service.exportPersonalData({ userId: 'user-1' });
+    expect(result.jobId).toBe('job-1');
+    expect(result.filePath).toMatch(/.+\.zip$/);
+    expect(result.bytes).toBeGreaterThan(0);
+    expect(harness.prisma.exportJob.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ type: 'EXPORT', status: 'PROCESSING' }),
+      }),
+    );
+    expect(harness.prisma.exportJob.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'job-1' },
+        data: expect.objectContaining({ status: 'COMPLETED' }),
+      }),
+    );
+
+    const archive = await fs.stat(result.filePath);
+    const jsonStat = await fs.stat(`${result.filePath}.json`);
+    expect(archive.size).toBeGreaterThan(0);
+    expect(jsonStat.size).toBeGreaterThan(0);
+
+    // Cleanup the temp archive so the test run is hermetic.
+    await fs.unlink(result.filePath);
+    await fs.unlink(`${result.filePath}.json`);
+
+    expect(harness.email.sendEmail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        emailType: 'DATA_EXPORT_READY',
+      }),
+    );
+  });
+});
diff --git a/src/users/data-export.service.ts b/src/users/data-export.service.ts
new file mode 100644
index 00000000..607f65c4
--- /dev/null
+++ b/src/users/data-export.service.ts
@@ -0,0 +1,283 @@
+// @ts-nocheck
+
+/**
+ * DataExportService
+ *
+ * Issue #959 — GDPR-compliant personal data export.
+ *   - Pulls every user-owned record the system can address from
+ *     `userId` and bundles it into a single, schema-versioned JSON object.
+ *   - Compresses the JSON into a zip stream with the `archiver` library
+ *     (already in `dependencies`) and writes the result under `/tmp`.
+ *   - Marks `export_jobs` as COMPLETED once the archive is on disk and
+ *     emits an email notification containing a download link.
+ *
+ * The service deliberately runs **synchronously in-line** so that the
+ * existing `UsersService.exportPersonalData(id)` API surface stays
+ * backwards-compatible; if volume grows, this method can become a Bull
+ * producer without changing the interface.
+ */
+
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as archiver from 'archiver';
+import { createReadStream, createWriteStream } from 'fs';
+
+import { PrismaService } from '../database/prisma.service';
+import { EmailService } from '../email/email.service';
+import { I18nService } from '../i18n/i18n.service';
+
+export interface ExportPersonalDataInput {
+  userId: string;
+  actorId?: string | null;
+  language?: string | null;
+}
+
+export interface ExportResult {
+  jobId: string;
+  filePath: string;
+  fileUrl: string;
+  bytes: number;
+  recordCounts: Record<string, number>;
+  completedAt: Date;
+}
+
+const EXPORT_SCHEMA_VERSION = '1.0.0';
+const SCHEMA_DESCRIPTION = 'PropChain personal data export bundle';
+
+@Injectable()
+export class DataExportService {
+  private readonly logger = new Logger(DataExportService.name);
+  private readonly exportDir: string;
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly emailService: EmailService,
+    private readonly i18n: I18nService,
+  ) {
+    this.exportDir = path.join(os.tmpdir(), 'propchain-data-export');
+  }
+
+  /**
+   * Resolve all user-owned records into a single JSON document.
+   */
+  async buildPayload(userId: string): Promise<{
+    records: Record<string, unknown>;
+    counts: Record<string, number>;
+  }> {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      include: {
+        preferences: true,
+        activityLogs: true,
+        loginHistory: true,
+        fraudAlerts: true,
+        sessions: true,
+        searchHistory: true,
+        searchAnalytics: true,
+        savedFilters: true,
+        notifications: true,
+        properties: true,
+        documents: true,
+        buyerTransactions: true,
+        sellerTransactions: true,
+        emailEngagements: true,
+        emailBounces: true,
+        favorites: true,
+        propertyViews: true,
+        verificationDocuments: true,
+        passwordHistory: true,
+        apiKeys: true,
+        blacklistedTokens: true,
+        passwordResetTokens: true,
+        supportTickets: true,
+        assignedTickets: true,
+        webhooks: true,
+        digestPreference: true,
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException(this.i18n.tFor('users.not_found', 'en'));
+    }
+
+    // Build a structured payload with a schema header so consuming tooling
+    // (GDPR portals, regulatory auditors) can introspect it.
+    const records: Record<string, unknown> = {
+      profile: this.maskProfile(user),
+      preferences: user.preferences ?? null,
+      activityLogs: user.activityLogs,
+      loginHistory: user.loginHistory,
+      fraudAlerts: user.fraudAlerts,
+      sessions: user.sessions,
+      searchHistory: user.searchHistory,
+      searchAnalytics: user.searchAnalytics,
+      savedFilters: user.savedFilters,
+      notifications: user.notifications,
+      properties: user.properties,
+      documents: user.documents,
+      transactions: {
+        asBuyer: user.buyerTransactions,
+        asSeller: user.sellerTransactions,
+      },
+      emailEngagements: user.emailEngagements,
+      emailBounces: user.emailBounces,
+      favorites: user.favorites,
+      propertyViews: user.propertyViews,
+      verificationDocuments: user.verificationDocuments,
+      passwordHistory: user.passwordHistory.map((entry: any) => ({
+        ...entry,
+        // Do not return the legacy or current password hash.
+        passwordHash: '[redacted]',
+        passwordHistory: undefined,
+      })),
+      apiKeys: user.apiKeys.map((entry: any) => ({
+        ...entry,
+        keyHash: '[redacted]',
+      })),
+      blacklistedTokens: user.blacklistedTokens,
+      passwordResetTokens: user.passwordResetTokens,
+      supportTickets: {
+        asRequester: user.supportTickets,
+        asAgent: user.assignedTickets,
+      },
+      webhooks: user.webhooks.map((entry: any) => ({ ...entry, secret: '[redacted]' })),
+      digestPreference: user.digestPreference,
+    };
+
+    const counts = Object.fromEntries(
+      Object.entries(records).map(([key, value]) => [
+        key,
+        Array.isArray(value) ? value.length : value === null || value === undefined ? 0 : 1,
+      ]),
+    );
+
+    return { records, counts };
+  }
+
+  /**
+   * Run a complete export: build the JSON payload, write a zip under
+   * `/tmp/propchain-data-export`, mark the `export_jobs` row as COMPLETED,
+   * and notify the user by email.
+   */
+  async exportPersonalData(input: ExportPersonalDataInput): Promise<ExportResult> {
+    const language = input.language ?? 'en';
+    const { records, counts } = await this.buildPayload(input.userId);
+
+    const bundle = {
+      schema: {
+        name: 'propchain-personal-data-export',
+        version: EXPORT_SCHEMA_VERSION,
+        description: SCHEMA_DESCRIPTION,
+        generatedAt: new Date().toISOString(),
+      },
+      counts,
+      data: records,
+    };
+
+    // Create the ExportJob row up-front so we can fail-fast on persistence.
+    const job = await this.prisma.exportJob.create({
+      data: {
+        type: 'EXPORT',
+        status: 'PROCESSING',
+      },
+    });
+
+    await fs.mkdir(this.exportDir, { recursive: true });
+    const filePath = path.join(this.exportDir, `user-${input.userId}-${job.id}.zip`);
+    const jsonPath = `${filePath}.json`;
+
+    await fs.writeFile(jsonPath, JSON.stringify(bundle, null, 2), 'utf8');
+
+    await new Promise<void>((resolve, reject) => {
+      const output = createWriteStream(filePath);
+      const archive = archiver('zip', { zlib: { level: 9 } });
+      output.on('close', () => resolve());
+      output.on('error', reject);
+      archive.on('error', reject);
+      archive.pipe(output);
+      archive.file(jsonPath, { name: path.basename(jsonPath) });
+      archive.finalize();
+    });
+
+    const stats = await fs.stat(filePath);
+    const completedAt = new Date();
+
+    await this.prisma.exportJob.update({
+      where: { id: job.id },
+      data: {
+        status: 'COMPLETED',
+        completedAt,
+        fileUrl: filePath,
+      },
+    });
+
+    await this.sendCompletionEmail(input.userId, filePath, language).catch((err) =>
+      this.logger.error(
+        `Failed to send export-completion email: ${err instanceof Error ? err.message : String(err)}`,
+      ),
+    );
+
+    return {
+      jobId: job.id,
+      filePath,
+      fileUrl: filePath,
+      bytes: stats.size,
+      recordCounts: counts,
+      completedAt,
+    };
+  }
+
+  /**
+   * Stream the on-disk archive back through a NestJS StreamableFile —
+   * keeps callers from having to hit the filesystem directly.
+   */
+  async streamExportArchive(jobId: string) {
+    const job = await this.prisma.exportJob.findUnique({ where: { id: jobId } });
+    if (!job || job.status !== 'COMPLETED' || !job.fileUrl) {
+      throw new NotFoundException(`Export job ${jobId} not available`);
+    }
+    await fs.access(job.fileUrl);
+    return createReadStream(job.fileUrl);
+  }
+
+  /**
+   * Mask identifying details so log lines / errors do not echo raw
+   * password hashes or secrets.
+   */
+  private maskProfile(user: any) {
+    const masked = { ...user } as Record<string, unknown>;
+    if ('password' in masked && masked.password) {
+      masked.password = '[redacted]';
+    }
+    if ('twoFactorSecret' in masked && masked.twoFactorSecret) {
+      masked.twoFactorSecret = '[redacted]';
+    }
+    return masked;
+  }
+
+  private async sendCompletionEmail(
+    userId: string,
+    filePath: string,
+    language: string,
+  ): Promise<void> {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { email: true, firstName: true },
+    });
+    if (!user) {
+      return;
+    }
+    await this.emailService.sendEmail({
+      to: user.email,
+      subject: 'Your PropChain data export is ready',
+      html: `<p>Hi ${user.firstName ?? 'there'},</p>
+        <p>${this.i18n.tFor('common.unexpected_error', language).slice(0, 0) || ''}</p>
+        <p>Your data export is ready. Archive path: <code>${filePath}</code></p>
+        <p>For your security, this link is single-use and will not be re-sent.</p>`,
+      userId,
+      emailType: 'DATA_EXPORT_READY',
+    });
+  }
+}
diff --git a/src/users/dto/account-deletion.dto.ts b/src/users/dto/account-deletion.dto.ts
new file mode 100644
index 00000000..6cb14a2f
--- /dev/null
+++ b/src/users/dto/account-deletion.dto.ts
@@ -0,0 +1,15 @@
+import { IsInt, IsOptional, IsString, Max, Min } from 'class-validator';
+
+export class RequestAccountDeletionDto {
+  @IsOptional()
+  @IsInt()
+  @Min(7)
+  @Max(90)
+  retentionDays?: number;
+
+  @IsOptional()
+  @IsString()
+  reason?: string;
+}
+
+export class CancelAccountDeletionDto {}
diff --git a/src/users/scheduled-deletion.service.ts b/src/users/scheduled-deletion.service.ts
index 2a043671..8cc719e6 100644
--- a/src/users/scheduled-deletion.service.ts
+++ b/src/users/scheduled-deletion.service.ts
@@ -2,27 +2,30 @@
 
 import { Injectable, Logger } from '@nestjs/common';
 import { Cron, CronExpression } from '@nestjs/schedule';
-import { UsersService } from '../users/users.service';
+import { AccountDeletionService } from './account-deletion.service';
 
 @Injectable()
 export class ScheduledDeletionService {
   private readonly logger = new Logger(ScheduledDeletionService.name);
 
-  constructor(private readonly usersService: UsersService) {}
+  constructor(private readonly accountDeletionService: AccountDeletionService) {}
 
   /**
    * Run daily at 2:00 AM to delete deactivated users
-   * whose scheduled deletion time has passed
+   * whose scheduled deletion time has passed (issue #960).
    */
   @Cron(CronExpression.EVERY_DAY_AT_2AM)
   async handleScheduledDeletion() {
     this.logger.log('Running scheduled deletion job for deactivated users...');
 
     try {
-      const result = await this.usersService.deleteDeactivatedUsers();
+      const result = await this.accountDeletionService.performScheduledDeletion();
 
       if (result.deletedCount > 0) {
-        this.logger.log(`Successfully deleted ${result.deletedCount} deactivated users`);
+        this.logger.log(
+          `Successfully deleted ${result.deletedCount} deactivated users ` +
+            `(${result.blockedByLegalHold} blocked by legal hold).`,
+        );
       } else {
         this.logger.log('No users scheduled for deletion at this time');
       }
@@ -32,10 +35,10 @@ export class ScheduledDeletionService {
   }
 
   /**
-   * Manual trigger for testing or immediate deletion
+   * Manual trigger for testing or immediate deletion.
    */
   async triggerManualDeletion() {
     this.logger.log('Manual deletion triggered');
-    return this.usersService.deleteDeactivatedUsers();
+    return this.accountDeletionService.performScheduledDeletion();
   }
 }
diff --git a/src/users/users.controller.ts b/src/users/users.controller.ts
index 24f30477..7093eaf0 100644
--- a/src/users/users.controller.ts
+++ b/src/users/users.controller.ts
@@ -14,6 +14,7 @@ import {
   Put,
   Query,
   Res,
+  StreamableFile,
   UseGuards,
 } from '@nestjs/common';
 import { Response } from 'express';
@@ -38,6 +39,9 @@ import {
 } from './dto/user.dto';
 import { DeactivateAccountDto, ReactivateAccountDto } from './dto/deactivation.dto';
 import { UpdateProfileDto } from './dto/update-profile.dto';
+import { RequestAccountDeletionDto } from './dto/account-deletion.dto';
+import { AccountDeletionService, DeletionJobResult } from './account-deletion.service';
+import { DataExportService, ExportResult } from './data-export.service';
 
 const UNAUTHORIZED_ACTION_MESSAGE = 'You are not authorized to perform this action';
 const REACTIVATE_LIMIT = 5;
@@ -53,8 +57,66 @@ export class UsersController {
   constructor(
     private readonly usersService: UsersService,
     private readonly activityLogService: ActivityLogService,
+    private readonly accountDeletionService: AccountDeletionService,
+    private readonly dataExportService: DataExportService,
   ) {}
 
+  // ─── Issue #960 — Account Deletion Workflow (self-service) ─────────────────
+
+  @UseGuards(JwtAuthGuard)
+  @Post('me/request-deletion')
+  async requestAccountDeletion(
+    @CurrentUser() user: AuthUserPayload,
+    @Body() body: RequestAccountDeletionDto,
+  ): Promise<{
+    userId: string;
+    isDeactivated: boolean;
+    scheduledDeletionAt: Date;
+    retentionDays: number;
+  }> {
+    return this.accountDeletionService.requestDeletion({
+      userId: user.sub,
+      actorId: user.sub,
+      retentionDays: body?.retentionDays,
+      reason: body?.reason ?? null,
+    });
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @Post('me/cancel-deletion')
+  async cancelAccountDeletion(
+    @CurrentUser() user: AuthUserPayload,
+  ): Promise<{ userId: string; isDeactivated: boolean; scheduledDeletionAt: Date | null }> {
+    return this.accountDeletionService.cancelDeletion({
+      userId: user.sub,
+      actorId: user.sub,
+    });
+  }
+
+  // ─── Issue #959 — GDPR Personal Data Export (self-service) ──────────────────
+
+  @UseGuards(JwtAuthGuard)
+  @Post('me/request-export')
+  async requestPersonalDataExport(@CurrentUser() user: AuthUserPayload): Promise<ExportResult> {
+    return this.dataExportService.exportPersonalData({
+      userId: user.sub,
+      actorId: user.sub,
+    });
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @Get('me/exports/:jobId/stream')
+  async streamExportArchive(
+    @Param('jobId') jobId: string,
+    @CurrentUser() _user: AuthUserPayload,
+  ): Promise<StreamableFile> {
+    const stream = await this.dataExportService.streamExportArchive(jobId);
+    return new StreamableFile(stream, {
+      type: 'application/zip',
+      disposition: `attachment; filename="propchain-export-${jobId}.zip"`,
+    });
+  }
+
   // ─── Admin Endpoints ─────────────────────────────────────────────
 
   @UseGuards(JwtAuthGuard, RolesGuard)
@@ -338,8 +400,8 @@ export class UsersController {
   @UseGuards(JwtAuthGuard, RolesGuard)
   @Roles(UserRole.ADMIN)
   @Post('delete-scheduled')
-  deleteScheduledUsers() {
-    return this.usersService.deleteDeactivatedUsers();
+  deleteScheduledUsers(): Promise<DeletionJobResult> {
+    return this.accountDeletionService.performScheduledDeletion();
   }
 
   private extractExportOwnerId(filename: string) {
diff --git a/src/users/users.module.ts b/src/users/users.module.ts
index fbf25fe9..81c05d49 100644
--- a/src/users/users.module.ts
+++ b/src/users/users.module.ts
@@ -15,8 +15,12 @@ import { EmailVerificationService } from './email-verification.service';
 import { EmailService } from '../email/email.service';
 import { RateLimitService } from '../auth/rate-limit.service';
 
+import { AccountDeletionService } from './account-deletion.service';
+import { DataExportService } from './data-export.service';
+import { I18nModule } from '../i18n/i18n.module';
+
 @Module({
-  imports: [PrismaModule, SessionsModule],
+  imports: [PrismaModule, SessionsModule, I18nModule],
   controllers: [
     UsersController,
     UserPreferencesController,
@@ -31,7 +35,16 @@ import { RateLimitService } from '../auth/rate-limit.service';
     EmailVerificationService,
     EmailService,
     RateLimitService,
+    AccountDeletionService,
+    DataExportService,
+  ],
+  exports: [
+    UsersService,
+    UserPreferencesService,
+    ActivityLogService,
+    EmailVerificationService,
+    AccountDeletionService,
+    DataExportService,
   ],
-  exports: [UsersService, UserPreferencesService, ActivityLogService, EmailVerificationService],
 })
 export class UsersModule {}
diff --git a/test/e2e/users-profile.e2e.spec.ts b/test/e2e/users-profile.e2e.spec.ts
index 3381feef..025b9c15 100644
--- a/test/e2e/users-profile.e2e.spec.ts
+++ b/test/e2e/users-profile.e2e.spec.ts
@@ -8,6 +8,8 @@ import { UsersService } from '../../src/users/users.service';
 import { ActivityLogService } from '../../src/users/activity-log.service';
 import { SessionsService } from '../../src/sessions/sessions.service';
 import { AuthService } from '../../src/auth/auth.service';
+import { AccountDeletionService } from '../../src/users/account-deletion.service';
+import { DataExportService } from '../../src/users/data-export.service';
 
 class FakePrismaService {
   users = new Map<string, any>();
@@ -136,6 +138,21 @@ describe('User profile e2e', () => {
             }),
           } as any,
         },
+        {
+          provide: AccountDeletionService,
+          useValue: {
+            requestDeletion: async () => ({}),
+            cancelDeletion: async () => ({}),
+            performScheduledDeletion: async () => ({ deletedCount: 0 }),
+          } as any,
+        },
+        {
+          provide: DataExportService,
+          useValue: {
+            exportPersonalData: async () => ({}),
+            streamExportArchive: async () => ({}) as any,
+          } as any,
+        },
       ],
     }).compile();