Under Article 30 I must maintain records of processing, and as my processor you feed those records. Can you actually tell me what personal data you process, where, and why — or will I get a shrug?

The full executive answer

You'll get a registry, in code, that version-controls. We maintain a data-protection registry as a first-class module — the record-of-processing artefact: which tables hold personal data, what categories, and the register is explicitly annotated as the thing to extend whenever a new personal-data store is added, so it evolves with the schema rather than rotting in a document repository. Alongside it, a data-classification module assigns sensitivity levels per table and column, and our GDPR export embeds that classification in its own metadata — the export literally describes which of its columns are personal or sensitive, which your RoPA can consume directly.

The processing picture in one breath, as your Article 30(2) record needs it: categories — business user identities (names, emails, roles), organisational assessment content that may incidentally contain personal data, usage telemetry, payment metadata (never card numbers — those go directly to PCI-certified processors); purposes — providing the governed decision-support service, billing, security; location — AWS Tokyo under Japan's adequacy decision; sub-processors — the ten named in our DPA with purposes each; retention — a declarative retention-policy module classifying every table's window and rationale, with tenant data deleted only via the explicit erasure pipeline; security measures — the RLS isolation, encryption, and audit-trail controls we've covered.

The honest edge: assessment free-text is customer-authored, so its personal-data content is under your control, not ours — our contribution there is defensive: PII detection and redaction before any text reaches an AI model, and PII masking in logs, which limits propagation of whatever personal data your users type in. That division — you control what enters, we control where it can flow — is the correct Article 28 processor posture, and it's the one our DPA documents.