GDPR & Data Protection
Overview
Primebrick is designed with data protection by design and by default (GDPR Article 25). The framework provides built-in mechanisms that help organizations meet their obligations under the EU General Data Protection Regulation (GDPR) and similar data protection laws.
Data minimization
Primebrick's DAL (Data Access Layer) enforces field-level access control through the RBAC permission system. API responses only include fields the user is authorized to see — sensitive fields (e.g., PII) are stripped automatically for users without the appropriate clearance.
Audit trails
Every create, update, delete, and restore operation is recorded in an immutable audit trail. The audit log captures:
- Who: the user ID and organization
- What: the entity, record UUID, and action (create/update/delete/restore)
- When: ISO 8601 timestamp
- What changed: the diff between old and new values (for updates)
Audit trails are retained indefinitely and cannot be modified by application users. This supports GDPR Article 30 (records of processing activities) and Article 33 (breach notification — the audit trail shows exactly what was accessed or modified).
Soft-delete and the right to be forgotten
Primebrick uses soft-delete by default — records are marked as deleted
(deleted_at timestamp) but remain in the database. This supports:
- GDPR Article 17 (right to erasure): A hard-delete operation can be performed to permanently remove a record and its audit history when legally required.
- GDPR Article 15 (right of access): Soft-deleted records can be retrieved for data subject access requests.
- Recovery: Accidental deletions can be restored via the
restore_recordoperation.
Multi-tenant data isolation
Primebrick enforces organization-level data isolation at the DAL layer. Every query is automatically scoped to the user's organization — there is no way for a user in Organization A to access data from Organization B, even if they know the UUID.
This supports GDPR Article 5(1)(c) (data minimization) and Article 32 (security of processing) by ensuring data is only accessible to authorized tenants.
Encryption
| Layer | Encryption |
|---|---|
| In transit | TLS 1.2+ (HTTPS) for all API traffic |
| At rest | PostgreSQL® TDE or disk-level encryption (deployment-dependent) |
| Passwords | Never stored — authentication is delegated to Casdoor™/OIDC |
| Tokens | JWT access tokens (short-lived) + refresh tokens (HttpOnly cookies) |
Data residency
Primebrick can be deployed on-premises or in any cloud region. This allows organizations to keep personal data within a specific jurisdiction (e.g., EU) to meet GDPR data residency requirements. There is no vendor lock-in — you control where your data lives.
GDPR articles supported
| Article | How Primebrick supports it |
|---|---|
| Art. 5 | Principles — data minimization via field-level RBAC, soft-delete |
| Art. 15 | Right of access — audit trails, soft-deleted records retrievable |
| Art. 17 | Right to erasure — hard-delete for permanent removal |
| Art. 25 | Data protection by design — multi-tenant isolation, RBAC, audit |
| Art. 30 | Records of processing — immutable audit trail |
| Art. 32 | Security of processing — TLS, encryption, MFA, step-up auth |
| Art. 33 | Breach notification — audit trail shows exactly what was accessed |
Standards & references
| Standard | Relevance |
|---|---|
| GDPR | EU General Data Protection Regulation |
| ISO/IEC 27701 | Privacy Information Management |
| ISO/IEC 27001 | Information Security Management Systems |