{"schema_version":"1.2.0","data_residency":{"primary_database_region":"eu-north-1 (Stockholm)","hosting_region":"EU edge (Vercel) — pre-launch migration to fully EU-hosted backend planned","backup_region":"eu-north-1 (Stockholm)"},"gdpr":{"legal_basis_tier1_roles":"Article 6(1)(f) — legitimate interest","legal_basis_api_consumers":"Article 6(1)(b) — contractual necessity","data_subject_rights_endpoint":"/privacy"},"subprocessors":[{"name":"Supabase","purpose":"Primary database","region":"EU (Stockholm, eu-north-1)","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Vercel","purpose":"Build + edge hosting (pre-launch; EU migration planned)","region":"EU edge","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Sentry","purpose":"Error tracking (no PII per scrubber config)","region":"EU","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Plausible","purpose":"Privacy-first analytics (cookieless, no PII)","region":"EU (Germany)","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Betterstack","purpose":"Uptime monitoring + hosted status page","region":"EU-region storage by default; US parent (Better Stack, Inc.) — transfers under the EU–US Data Privacy Framework with SCC fallback","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Maskinporten (Digdir)","purpose":"Norwegian government auth broker","region":"Norway (EU/EEA)","dpa_signed":false,"classification":"public_authority","dpa_status":"not_applicable"},{"name":"Lovdata","purpose":"Read-only legal-text reference (no data sent)","region":"Norway (EU/EEA)","dpa_signed":false,"classification":"data_source","dpa_status":"not_applicable"},{"name":"Resend","purpose":"Transactional email (welcome, magic link)","region":"EU (Ireland)","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Stripe","purpose":"Payment processing + subscription billing (Checkout, webhooks, invoicing)","region":"EU entity (Stripe Payments Europe Ltd, Ireland); US parent — transfers under the Stripe Data Transfers Addendum (SCCs / EU–US Data Privacy Framework)","dpa_signed":true,"classification":"processor","dpa_status":"signed"},{"name":"Altinn (Digdir)","purpose":"Norwegian government filing platform (submissions on the customer's behalf; mock by default, live flag-gated — not yet in production use)","region":"Norway (EU/EEA)","dpa_signed":false,"classification":"public_authority","dpa_status":"not_applicable"},{"name":"Skatteetaten","purpose":"Norwegian Tax Administration (VAT filing + status polling; mock by default, live flag-gated — not yet in production use)","region":"Norway (EU/EEA)","dpa_signed":false,"classification":"public_authority","dpa_status":"not_applicable"},{"name":"NAV","purpose":"Norwegian Labour and Welfare Administration (employment-relationship reads; mock by default, live flag-gated — not yet in production use)","region":"Norway (EU/EEA)","dpa_signed":false,"classification":"public_authority","dpa_status":"not_applicable"},{"name":"Google","purpose":"Preferred Sources button on guide pages (publisher.js script + button iframe loaded from news.google.com by the visitor's own browser; once loaded it persists for the rest of the client-side browsing session; no data sent by Apier's servers)","region":"United States (Google LLC) — browser-side loading only; transfer mechanism for that processing not asserted here (unverified — see DPA note)","dpa_signed":false,"classification":"independent_controller","dpa_status":"not_applicable"}],"retention":{"api_request_logs_days":30,"error_logs_days":30,"delta_logs_anonymized_after_months":12,"audit_log_retention":"forensic — see Processing Activities Register","evaluation_snapshots_retention_months":24},"audit":{"append_only":true,"correlation_id_header":"X-Correlation-ID","trust_metadata_on_every_response":true},"rulebook":{"last_updated":"2026-07-08T16:54:35.042523+00:00","recent_versions_endpoint":"/trust#rulebook-history"},"last_verified_at":"2026-08-24","generated_at":"2026-10-05T06:40:10.483Z"}