Sensitive data

Every field the Advocate keeps is classified, and every build proves where the personal, sensitive and secret ones actually go. A unique marker is planted in each such field; a student then uses the app by text, on the web, through the API, with a mentor introduction sent and a webhook registered; and every place data can land is searched for every marker. A marker found anywhere its class may not go fails the sensitive-data gate, naming the field and the place. The latest run is on the factory console's Sensitive data trace page.

The classes

pie showData title Fields by class
  "public" : 14
  "internal" : 62
  "personal" : 55
  "sensitive" : 13
  "secret" : 1

Where each class may go

flowchart LR
  P[personal]:::p
  S[sensitive]:::s
  X[secret]:::x
  k0[store]
  k1[sealed store]
  k2[consent ledger]
  k3[evidence]
  k4[student export]
  k5[student API]
  k6[student screens]
  k7[texts to the student]
  k8[calendar feed]
  k9[sent with approval]
  k10[network: campus services]
  k11[network: webhooks]
  k12[app admin]
  k13[outcomes]
  k14[server logs]
  P --> k0
  S --> k0
  P --> k4
  S --> k4
  P --> k5
  S --> k5
  P --> k6
  S --> k6
  P --> k7
  S --> k7
  P --> k8
  P --> k9
  X -. hashed or encrypted only .-> k0
  classDef p fill:#dbeafe,stroke:#1d4ed8
  classDef s fill:#fde68a,stroke:#b45309
  classDef x fill:#fecaca,stroke:#b91c1c

A field may declare one more place for itself, with a reason: the student's first name and the note they approved go to the mentor platform; their class-site token goes to the class site; their webhook address receives webhooks.

How it stays out

flowchart TB
  in[A fact comes in] --> q{Class}
  q -- personal or sensitive --> store[(App store, owned by the student)]
  q -- sealed fact --> sealed[(Sealed store: encrypted per student, opened only by granted identities)]
  q -- secret --> hash[Hashed or encrypted; never shown, not even in the student's export]
  store --> own[Back to the student: screens, texts, export, API]
  store -. approved exact text only .-> out[Sent with approval]
  store -. never .-> ev[(Evidence: keyed-hash subjects, no content)]
  store -. never .-> led[(Consent ledger: short hashes, never labels or names)]
  store -. never .-> adm[App admin and outcomes: counts of five or more only]

Personal, sensitive and secret fields

Sealed facts

The record, by sensitivity

Each field's class is shown beside it. A collection is as sensitive as its most sensitive field.

student

erDiagram
  students {
    string id PK "internal"
    string phone "personal"
    string chosenName "personal"
    string pronouns "sensitive"
    string zip "personal"
    string county "personal"
    number age "personal"
    string goal "personal"
    HelpDial dial "internal"
    Household household "sensitive"
    Enrollment enrollment "personal"
    object receives "sensitive"
    string_list helpAreas "sensitive"
    string_list communities "sensitive"
    string account "internal"
    date createdAt "internal"
  }

schedule

erDiagram
  deadlines {
    string id PK "internal"
    string studentId "internal"
    string title "personal"
    date due "personal"
    string course "personal"
    enum kind "internal"
    object source "personal"
    boolean confirmed "internal"
    number effortHours "internal"
    number durationMin "internal"
    boolean done "internal"
  }
  classes {
    string course "personal"
    weekday_list days "personal"
    time start "personal"
    time end "personal"
    string building "personal"
    string room "personal"
    string campus "personal"
  }
  shifts {
    date date "personal"
    time start "personal"
    time end "personal"
    string employer "personal"
  }
  holds {
    string id PK "internal"
    string deadlineId "internal"
    string title "personal"
    date date "personal"
    time start "personal"
    time end "personal"
  }
  reminders {
    string id PK "internal"
    string about "personal"
    date at "personal"
    string text "personal"
  }
  meetings {
    string id PK "internal"
    string title "personal"
    date date "personal"
    time start "personal"
    string_list attendees "personal"
    string course "personal"
  }
  courses {
    string course "personal"
    enum aiPolicy "public"
    string aiPolicyLine "public"
  }
  deadlines ||--o{ holds : "gets time in"

conversation

erDiagram
  drafts {
    string id PK "internal"
    string studentId "internal"
    string to "personal"
    string recipient "personal"
    string body "personal"
    string purpose "internal"
    enum status "internal"
  }
  messages {
    string id PK "internal"
    string studentId "internal"
    string author "internal"
    string text "personal"
    NextStep_list nextSteps "internal"
    enum urgency "internal"
    string why "internal"
    date_time at "internal"
    enum status "internal"
    string holdReason "internal"
  }
  last_steps {
    NextStep_list steps "internal"
  }
  pulse_state {
    record asked "internal"
    number everyDays "internal"
    boolean off "internal"
  }
  pulse_pending {
    string pulse "internal"
  }
  dismissed {
    string subject "personal"
    date at "internal"
  }

help and money

erDiagram
  playbook_runs {
    string playbook "sensitive"
    string studentId "internal"
    string stepId "internal"
    enum status "internal"
    date startedAt "internal"
    object_list history "sensitive"
    date waitingSince "internal"
  }
  vault {
    string name "sensitive"
    date addedAt "internal"
  }
  money {
    number balance "sensitive"
    Bill_list bills "sensitive"
    Paycheck pay "sensitive"
  }
  household_plan {
    ChildCare childCare "sensitive"
    number commuteMin "personal"
    number sleepHours "personal"
    enum commuteMode "personal"
    string homeStop "personal"
  }
  aid {
    date disbursement "sensitive"
  }

connections

erDiagram
  sources {
    enum source "internal"
    date connectedAt "internal"
  }
  api_tokens {
    string id PK "internal"
    string label "personal"
    enum_list scopes "internal"
    date createdAt "internal"
  }
  webhooks {
    string id PK "internal"
    url url "personal"
    string_list events "internal"
    string secret "secret"
  }

campus

erDiagram
  commute_plans {
    date date "personal"
    string course "personal"
    time classStart "personal"
    string from "personal"
    string to "personal"
    Itinerary_list itineraries "personal"
    string notice "public"
    date_time fetchedAt "internal"
  }
  transit_now {
    string stop "personal"
    date_time at "internal"
    Arrival_list arrivals "public"
    Alert_list alerts "public"
  }
  dispatches {
    string id PK "internal"
    string studentId "internal"
    enum kind "internal"
    object request "personal"
    string key "internal"
    enum status "internal"
    number attempts "internal"
    object result "personal"
    date_time queuedAt "internal"
  }
  campus_feeds {
    string campus PK "public"
    date_time fetchedAt "internal"
    DiningLocation_list locations "public"
    record hours "public"
    record menus "public"
    Space_list spaces "public"
    Event_list events "public"
    Posting_list postings "public"
    Mentor_list mentors "public"
    Stop_list stops "public"
    string_list unknown "internal"
  }
  leases {
    string job PK "internal"
    string holder "internal"
    date_time until "internal"
    number beats "internal"
  }

Verified by

• `apps/advocate/test/sensitive.test.ts` (7 test definitions)