Noxys Pre-Filled DPIA Sections — Data Sources
This page documents the canonical source of truth for every section of the DPIA template that is pre-filled by Noxys. It allows a Customer's DPO to:
- Verify that the pre-filled content is accurate at the time the DPIA is signed.
- Update the DPIA when Noxys publishes a change to a referenced ADR, sub-processor list, or policy.
- Cite authoritative references in the final DPIA.
All sources below are public unless explicitly marked. Internal sources are available on request to dpo@noxys.eu under the customer's DPA.
Section-by-Section Source Mapping
| DPIA section | Pre-filled content | Source of truth |
|---|---|---|
| 1.1 Nature of processing | Three deployment methods, four policy actions | Architecture: docs/architecture/c4/01-context.md, docs/platform/architecture.md |
| 1.4 Data subjects | Employees, contractors, authorised third parties | docs/security/data-handling.md, DPA Section 1.3 |
| 1.4 Data categories | Professional identity, AI usage metadata, transient prompt content | docs/platform/pii-detection.md, classifier output schema in docs/api/events.md |
| 1.4 Geographic scope | EU only (Scaleway Paris) | ADR-008 (EU residency), docs/legal/sub-processors.md |
| 1.5 Data flows (Mermaid) | Extension/Agent/Proxy → in-memory classifier → API → DB | docs/architecture/c4/02-container.md, docs/architecture/c4/03-component-api.md |
| 1.6 Retention durations | 90d fingerprints, 365d audit, 24mo metrics | ADR-019 (Storage Tiers), docs/security/data-handling.md |
| 1.7 Sub-processors | Scaleway, Stripe, OVH | docs/legal/sub-processors.md — canonical list, updated within 30 days of any change |
| 2.1 Purpose limitation | No AI training, no marketing, no commercial profiling | DPA Section 2.2 (docs/legal/dpa-template.md) |
| 2.2 Data minimisation | SHA-256 fingerprints, no raw prompt persistence | ADR-007 (Hashed Fingerprints) |
| 2.5 Integrity & confidentiality | TLS 1.3, AES-256-GCM, per-tenant KMS, MFA | docs/legal/gdpr-art32-pack.md, docs/security/saml-key-hardening.md |
| 3.1 Illegitimate access risks | Pre-assessed Negligible/Limited; CLOUD Act mitigated | docs/security/trust-center.md, annual pentest report (available under NDA) |
| 3.2 Modification risks | Append-only logs, versioned classifiers | docs/api/events.md, classifier release notes in docs/handbook/release-process.md |
| 3.3 Disappearance risks | Daily encrypted backups, RPO 24h / RTO 4h | docs/security/data-handling.md, DPA Section 3 |
| 4.1 Technical measures | Local redaction, hashing, encryption, RBAC, audit | docs/legal/gdpr-art32-pack.md, docs/security/compliance.md |
| 4.2 Organisational measures | DPA, Art. 30 records, breach notification, sub-processor governance | docs/legal/dpa-template.md, docs/legal/gdpr-art30-skeleton.md |
| 5.1 Residual risk recommendation | Acceptable / Low | Aggregated from sections 3 + 4 above |
Placeholder Reference
The generation script (scripts/generate-dpia.sh) supports the following placeholders. Each is substituted in both the English and French templates.
Required (must be supplied via --customer and --processing-name)
| Placeholder | Meaning | Example |
|---|---|---|
{{customer_name}} | Legal name of the Data Controller | Acme Corp SA |
{{processing_name}} | Internal name of the processing | Noxys deployment for Acme Engineering teams |
Recommended (supplied via --field key=value flags)
| Placeholder | Meaning | Default |
|---|---|---|
{{controller_representative}} | Person signing on behalf of the controller | [To be completed] |
{{customer_dpo}} | Name of the Customer's DPO | [To be completed] |
{{customer_dpo_email}} | Email of the Customer's DPO | [To be completed] |
{{customer_purpose}} | Specific business purpose | [To be completed] |
{{lead_supervisory_authority}} | Lead supervisory authority | CNIL (FR) |
{{user_count}} | Estimated number of users | [To be completed] |
{{daily_prompts}} | Estimated daily prompt volume | [To be completed] |
{{retention_tier}} | Storage tier selected | Standard (90d / 365d / 24mo) |
{{retention_details}} | Override details if applicable | Default Noxys retention |
{{dpia_author}} | Name of the DPIA author | [Customer DPO] |
{{dpia_date}} | Date the DPIA is finalised | Today (autofilled by script) |
{{customer_security_lead}} | Customer CISO / Security lead | [To be completed] |
{{residual_risk_level}} | Final residual risk level | Acceptable / Low (pre-assessed) |
Override fields (rarely needed)
| Placeholder | Meaning | Default |
|---|---|---|
{{data_subjects_override}} | Override the standard data-subject scope | — |
{{data_categories_override}} | Override the standard data categories | — |
{{special_categories_override}} | Override special-category statement | — |
{{processing_duration_override}} | Override the processing duration | — |
{{date_controller}} | Signature date of controller | empty for manual signature |
{{date_dpo}} | Signature date of DPO | empty for manual signature |
{{date_security}} | Signature date of security lead | empty for manual signature |
{{date_noxys}} | Signature date of Noxys DPO | empty for manual signature |
{{consultation_date}} | Date of Art. 36 consultation if initiated | empty |
Change Management
When Noxys publishes a change that affects DPIA pre-fill content, the following are updated simultaneously:
- The source-of-truth document (ADR, sub-processor list, DPA template)
- The DPIA templates (
dpia-template.mdanddpia-template-fr.md) - The "Last Updated" header in both DPIA templates
- A changelog entry on the Trust Center
Customers with active deployments are notified via the channel agreed in their DPA (typically change-notifications@<customer>.com or the Customer admin in the Noxys Console).
Validation Checklist for DPOs
Before signing a DPIA generated from this template, confirm:
- The "Last Updated" date on the DPIA template is within the past 90 days
- The sub-processor list matches the current version on the public page
- The chosen deployment method (Extension / Agent / Proxy) matches the actual Noxys configuration
- The lawful basis selected matches the Customer's internal legal analysis
- The lawful-basis section has been reviewed with the Customer's employment-law counsel where relevant
- Employee representatives have been consulted where required (FR: CSE; DE: Betriebsrat; etc.)
- The residual risk level reflects the Customer's own assessment, not only the Noxys default
- The DPIA is registered in the Customer's internal DPIA registry (CNIL recommends keeping a register)
Compliance Expert Validation Note
The acceptance criteria for PII-6 includes "compliance expert validation". This is a post-ship requirement:
- Noxys SAS will engage external GDPR counsel (target: a CNIL-accredited firm) to perform a formal review of this template by 2026 Q3.
- The review report and any resulting amendments will be published as an updated version of this template on this same path.
- Customers are encouraged to perform their own legal review with their preferred counsel before adopting the template verbatim.