Audit & privacy
LEMA Chat is built for a sovereign posture: an open-source spine, data and inference kept EU/IoM, a tamper-evident record of what happened, and self-service data rights for every user.
The audit log
Every consequential action is written to an audit log protected by a global SHA-256 hash chain: each entry is chained to the one before it, so the record is append-only and any tampering is detectable.
- View the log from the Admin console's Audit page.
- Verify the chain — a verification endpoint re-walks the entire chain and confirms it hasn't been altered. If any row were changed or removed, verification would fail.
Because the chain is append-only, even erasure (below) is recorded as a new event rather than by editing history — preserving the chain's integrity while honouring the deletion.
GDPR: data-subject rights
Users exercise their own data rights without an admin — the flows act only on the caller's own account:
- Export (Art. 15 / 20) — a user downloads a machine-readable JSON bundle of their data.
- Erasure (Art. 17) — a user irreversibly erases themselves. Erasure crypto-shreds their BYOK secrets, redacts content they authored, hard deletes their files/avatars/push subscriptions/memberships, and anonymises their user row. It's idempotent, and it refuses (with a clear
sole_ownererror) if the user is the only owner of a shared workspace — so a workspace can't be orphaned by an erasure.
The compliance gate
Synthetic data only, for now
LEMA Chat carries an explicit compliance gate: synthetic data only until EU-ZDR inference, a DPIA, and a ROPA are live. No real personal or client data should touch any surface before then. This is a product-level rule, not a suggestion — plan your rollout around it.
Related security settings
Hardening levers — content-security-policy, CORS, HSTS, rate limits, and the security feature flags — live under SuperAdmin settings. See the SuperAdmin appendix.