cratis-chronicle-compliance

Chronicle compliance and personal data

Chronicle keeps events forever, so personal data cannot be deleted from the log. Chronicle protects it by encrypting each marked value under a key owned by the subject, and erases it by destroying that key. Decide the subject before you decide the event shape — the subject is what erasure operates on.

Verified product sources

Sources:

Package	Purpose
Cratis.Chronicle	Cratis.Chronicle.Compliance.GDPR, Cratis.Chronicle.SubjectAttribute, IEventSequence.Redact, IReadModels.Release
Cratis.Chronicle.CodeAnalysis	CHR0026, CHR0034, CHR0035, CHR0043, CHR0046

Reverify product sources before claiming support for another version.

Mark personal data with [PII]

Cratis.Chronicle.Compliance.GDPR.PIIAttribute marks a value as personal data. It targets a class, a property, or a constructor parameter, and it is not repeatable.

using Cratis.Chronicle.Compliance;
using Cratis.Chronicle.Compliance.GDPR;

[EventType]
public record <PersonEventName>(
    [property: PII] string <PersonalPropertyName>,
    <NonPersonalType> <BusinessPropertyName>);

On a positional record the attribute must be written as [property: PII] or placed on the constructor parameter; Chronicle looks for it on the property, the property's declaring type, the property's own type, and the matching primary constructor parameter.

Marking the concept type itself makes the value personal everywhere it appears, which is usually what you want for an email, a phone number, or a personal name:

[PII]
[ComplianceDetails("<why this value is collected and under what basis>")]
public record <ConceptName>(string Value) : ConceptAs<string>(Value);

PIIAttribute accepts an optional details string, but Chronicle never reads it. The rationale that actually reaches the event schema comes from Cratis.Chronicle.Compliance.ComplianceDetailsAttribute. Write [PII] for the marker and [ComplianceDetails("...")] for the reason; do not write [PII("reason")] and expect the reason to be recorded.