Architecture center
How PIEDAP Consent is built, how it proves a consent and how it protects data, for architects, security reviewers and auditors.
The architecture center describes how PIEDAP Consent is built: its parts, the path each request takes, how a consent is proven and how data is protected. It is for architects, security reviewers and auditors who assess the product or check its evidence.
Start with:
- Components, for the parts and how they connect
- How consent is proven, for the evidence design
- Security model, for a vendor assessment
Design
- ComponentsThe console, the API, the browser runtime, the SDKs, PostgreSQL, Redis and the scheduled jobs, and how they connect.
- Request flowsWhat happens, step by step, when a banner loads, a choice is saved, a webhook is sent and a person is erased.
- Tenancy and accessHow data is kept apart by project and property, how the console and the keys are scoped, and what the database enforces.
Evidence
- How consent is provenHow a consent record, its sealed event chain, a signed receipt and a daily anchor together prove what a person chose.
- ReceiptsWhat a signed consent receipt contains, how it is signed with Ed25519, and how a third party verifies one without the deployment.
- Daily anchorsHow each day's sealed events are combined into one signed Merkle root, and why keeping your own copy makes the proof independent.
- Notice campaign proofWhat a notice campaign commits to in signed roots, what is only reported by your sender, and how one person's evidence is checked.
Security
- Security modelThe security controls in the software as it ships, what they protect, and what the operator of a deployment must do.
- Keys and secretsThe secrets a deployment holds, the credentials a project holds, how each is stored, and which of them can be changed.
- Identifier hashingHow identifiers are stored as keyed hashes, what the pepper and the subject fingerprint are for, and where a readable identifier can still appear.
Deployment
- Deployment optionsThe two ways to run PIEDAP Consent, the shapes a self-hosted deployment can take, and what each choice means for responsibility and data location.