Add LGPD compliance audit reports (RIPD and technical findings) - #225
Open
danzeroum wants to merge 1 commit into
Open
Add LGPD compliance audit reports (RIPD and technical findings)#225danzeroum wants to merge 1 commit into
danzeroum wants to merge 1 commit into
Conversation
… + RIPD Revisão de conformidade do próprio BTV com a Lei 13.709/2018 e com os 7 princípios de Privacy by Design, cobrindo backend (Rust + Python), frontend, infraestrutura, banco de dados, ML/LLM, integrações e documentação. Dois entregáveis, nenhum dos quais existia no repositório: - docs/privacy/RELATORIO_TECNICO_LGPD.md — 48 achados verificados, cada um com localização arquivo:linha, artigo violado, princípio PbD, cenário de dano, recomendação técnica e trecho de código como evidência; cobertura item a item dos 13 blocos do checklist; plano de remediação em 4 ondas. - docs/privacy/RIPD.md — Relatório de Impacto à Proteção de Dados (Art. 5º, XVII e Art. 38): inventário de dados, fluxos, transferências internacionais, bases legais por finalidade, medidas de segurança, retenção, direitos do titular, riscos residuais com referência ao Art. 52, e bloco de aprovação. Severidade: 10 P0, 17 P1, 21 P2. Os P0 incluem gravação de dado sensível do Art. 11 em claro no WAL append-only, ausência total de criptografia em repouso, inexistência de expurgo e de endpoints de direitos do titular, ausência de controle de finalidade, bypass de autenticação no gateway e transferência internacional sem mecanismo do Art. 33. Nenhum arquivo de produção foi alterado — esta é a auditoria, não a remediação. Os documentos não foram adicionados ao nav do mkdocs.yml, para não publicar o detalhe de exploração no site enquanto os P0 estiverem abertos. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ENiZaB8nqSzosiUWLzRgRC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds comprehensive LGPD (Brazilian data protection law) compliance documentation for the BuildToValue system, including a detailed Data Protection Impact Report (RIPD) and a technical audit report identifying 48 findings across the codebase.
Changes
RIPD.md (646 lines): Complete Data Protection Impact Report documenting:
RELATORIO_TECNICO_LGPD.md (2428 lines): Technical audit report with evidence-based findings linked to specific code locations
Key Findings
The audit identifies a critical pattern: asymmetry between the compliance rules BTV enforces on client systems and the rules it follows itself. For example:
Status
This is a diagnostic audit, not a remediation. No findings have been fixed in this delivery. The document explicitly notes that residual risks are not acceptable for real personal data processing, particularly sensitive data under Art. 11, and recommends against production use until critical risks are mitigated.
The RIPD was not approved by a DPO and is intended to inform the remediation roadmap.
https://claude.ai/code/session_01ENiZaB8nqSzosiUWLzRgRC