Compliance
How platform controls map to LGPD, GDPR and SOC 2 Type II, and where the evidence lives.
This page is documentation, not legal advice. Your organization remains the data controller for the content you place in eworks.cloud. Use this mapping to inform your own assessment with counsel.
LGPD — Lei Geral de Proteção de Dados (Brazil)
Consent management
Consent for optional processing — product analytics, model quality sampling, marketing contact — is opt-in and recorded per user with timestamp, IP, policy version and purpose. Withdrawal is one click in Settings → Privacy and takes effect immediately; the withdrawal itself is written to the audit trail.
Core service processing (delivering chat, agents and storage you asked for) relies on contract, not consent, and cannot be switched off without terminating the service.
Data Subject Access Requests
| Stage | Owner | Target |
|---|---|---|
Request received (portal or privacy@eworks.cloud) | Privacy desk | Acknowledged same business day |
| Identity verification | Workspace admin | 1 business day |
| Bundle generation | Automated (e.audit) | Under 1 hour |
| Review and delivery | Privacy desk | Under 7 days end to end |
The SLA and every open request are visible on the compliance dashboard in e.dash. Bundles ship as JSON, CSV and PDF.
curl -X POST https://api.eworks.cloud/v1/privacy/dsar \
-H "Authorization: Bearer $EWORKS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"subject_email":"maria@example.com","format":"json","include":["profile","chats","agents","audit"]}'Right to be forgotten
Deletion is automated through tenant offboarding and per-subject erasure:
- Subject-level erasure removes profile, chat history, uploaded documents and derived embeddings within 30 days.
- Workspace offboarding purges all tenant data 30 days after termination, backups included within a further 35 days.
- Audit records are retained where retention is a legal obligation; the subject's identifiers in those records are pseudonymized rather than deleted, and the erasure is itself logged.
Data minimization and retention
| Data category | Collected | Default retention |
|---|---|---|
| Account identity (name, email, IdP subject) | Required | Life of account |
| Workspace content (chats, documents, agents) | Provided by you | Until deleted by you |
| Model prompt/response metadata (tokens, latency, model) | Required for billing | 24 months |
| Prompt and response bodies | Configurable per workspace | 0–24 months, off by default for restricted workspaces |
| Security and audit events | Required | 7 years |
| Product analytics | Consent-based | 14 months |
No special-category data is requested by the platform, and prompt bodies are never used to train third-party models.
Processor agreements
eworks.cloud acts as operator/processor. The DPA is signed electronically during onboarding, or downloaded from the Trust panel in e.dash for counter-signature. Sub-processors are listed in the DPA annex; customers receive 30 days' notice of any addition and may object.
Penalties matter. LGPD sanctions reach 2% of Brazilian revenue, capped at R$50 million per infraction, plus publication of the violation and suspension of processing. Configure retention and residency deliberately.
GDPR (European Union)
Lawful basis
| Processing | Lawful basis |
|---|---|
| Delivering chat, agents, storage and support | Contract, Art. 6(1)(b) |
| Security monitoring, fraud and abuse prevention | Legitimate interest, Art. 6(1)(f) |
| Audit retention, tax and accounting records | Legal obligation, Art. 6(1)(c) |
| Product analytics, marketing contact, quality sampling | Consent, Art. 6(1)(a) |
A legitimate interest assessment is available on request for the Art. 6(1)(f) processing.
Data Processing Agreement
The standard DPA covers Art. 28 processor obligations, documented instructions, confidentiality, sub-processor flow-down, assistance with Art. 32–36 duties, and deletion or return on termination. International transfers use the 2021 Standard Contractual Clauses plus a transfer impact assessment. EU-resident workspaces can be pinned so that content never leaves the EU region — see data residency.
Breach notification
| Step | Deadline |
|---|---|
| Detection and triage | Under 1 hour from alert |
| Containment | Under 4 hours |
| Controller notification (you) | Under 72 hours of becoming aware |
| Supervisory authority notification | By the controller, Art. 33 |
| Data subject notification, if high risk | Without undue delay, Art. 34 |
Notifications include the nature of the breach, categories and approximate number of records, likely consequences, measures taken and the contact point. Full procedure in incident response.
Penalties matter. GDPR fines reach €20 million or 4% of global annual turnover, whichever is higher.
SOC 2 Type II
The current report covers Security, Availability and Confidentiality over a 12-month observation window. It is available under NDA from security@eworks.cloud.
| Criterion | Control implemented | Evidence |
|---|---|---|
| CC6.1 — Logical access boundaries | Tenant isolation via row-level security, encrypted storage | Policy export, penetration test report |
| CC6.6 — External threat protection | WAF, DDoS mitigation, TLS 1.3 | Edge configuration export |
| CC6.7 — Data transmission and disposal | TLS 1.3, encrypted backups, documented purge | Key rotation records |
| CC7.1 — Monitoring | CloudWatch dashboards, anomaly detection, tuned alert thresholds | Alarm history, on-call pages |
| CC7.2 — Incident detection | Real-time security alerts, 24/7 on-call | Incident register |
| CC8.1 — Change management | PR review, SAST/DAST gates, deployment approvals | CI/CD run history |
| CC9.1 — Risk mitigation / logical access | MFA enforcement plus RBAC and ABAC | e.identity MFA report, role assignment audit events |
Trust Service Criteria evidence links
- Audit trail — e.audit,
https://audit.eworks.cloud, filtercategory=security - Encryption posture and key rotation — Trust panel in e.dash
- Access reviews — quarterly membership export from e.identity
- Vulnerability management — Snyk and Dependabot summaries in the Trust panel
Compliance checklist
| Feature | Control mapping |
|---|---|
| SSO federation | CC9.1, GDPR Art. 32, LGPD Art. 46 |
| MFA enforcement | CC9.1 |
| RBAC / ABAC | CC6.1, CC9.1 |
| Encryption at rest and in transit | CC6.7, GDPR Art. 32(1)(a) |
| Immutable 7-year audit log | CC7.1, CC7.2, LGPD Art. 37 |
| DSAR export | GDPR Art. 15, LGPD Art. 18 |
| Right to erasure | GDPR Art. 17, LGPD Art. 18 VI |
| Breach notification runbook | GDPR Art. 33–34, LGPD Art. 48 |
| Data residency selection | GDPR Chapter V |
| Annual penetration test | CC4.1 |