Reading the security-review documents

Explains F-DP-4's reading guide and F-OPS-4's audit export — what is generated, what is signed, and what is not claimed — for whoever is answering a customer's security review.

The four generated documents

botseon compliance data-map writes the data map and the Art. 30(2) record; botseon compliance subprocessors writes the sub-processor list and the transfer register. Both commands take --out <dir> to name the directory each document is written into, and --publish, which always renders all four documents together and books a version — a version whose sub-processor set changed opens a 30-day objection window. Two markers appear inside them: **[unverified]** beside an assertion no source states, and `[verify]` beside a register row nobody has signed off; either marker makes the document a list of what to confirm, not a statement.

What each document answers

The residency policy and the model routes

An organisation's residency policy is one of EU/EEA only, EU/EEA first or Anywhere a route requires: Only routes processed inside the EU/EEA are used. A request with no such route fails rather than leaving the area. is the EU/EEA only sentence, and it is the default at provisioning. A model route's own residency value (eu_guaranteed, self_hosted, us or global) and its data-retention status are what the transfer register reads to decide whether a route is a transfer at all. The document that would answer a classifier's or a DLP tool's own questions is F-DP-4's remaining half, still doing, and is not described here as if it existed.

The audit export

Organisation → Audit → Export offers a date range, Request export, Download and Chain unbroken; the same range is available from the command line: botseon audit export --org <orgId> --from <iso> --to <iso> --out <file>. Both verify the hash chain as they render, so an export that completes has already proved its own integrity.

The DPIA and the breach runbook

docs/compliance/dpia.md is Botseon's own assessment; docs/compliance/dpia-tenant-template.md is handed to a customer on request; the breach runbook is docs/operations/breach-runbook.md. None of the three is published on this site — a stranger on the public internet cannot reach any of them.

What we do not claim

No certification is held or claimed. The only residency wording used anywhere in this product's copy or documents is the one sentence scripts/check-claims.sh (see §2.10 of the design spec) exists to enforce — no stronger wording, and no synonym for it, appears anywhere else. A reader comparing this guide against a competitor's marketing should expect fewer claims here, not more.