Skip to main content

sigmashake-docs — DSAR runbook

How to handle a Data Subject Access Request (GDPR Articles 15-17, CCPA §1798.110): a person asking what data we have about them, exporting it, or deleting it.

The docs site is a static site. It has no accounts, no sessions, no database, and no audit log, so SigmaShake stores no personal data about its readers. A request that names the docs site needs no lookup or export from this service. Reader request metadata (IP address, user agent, referrer) reaches Cloudflare and Google Fonts; route a request about those logs to those sub-processors (see the DPA, Section 7). The steps below route the request to the service that does hold the data.

Eligibility check​

  1. Direct customer / operator. A person with a SigmaShake account. Their data is in the account service. Route the request to the account owner flow in the Privacy Policy (Section 8).
  2. Customer's monitored device / asset. Data is in the org's tenant resources; the customer (org_admin) is the data controller, not us. Route the request to the customer org_admin. We process on their behalf when they file via support.
  3. Billing contact. The billing contact is held by our payment sub-processor. See the sub-processor list in the DPA (Section 7).

This is the GDPR Articles 15-17 and CCPA data-subject-rights path. The full procedure is docs/compliance/dsr-procedure.md in the repository.

Find​

  1. Take the identifier from the requester (email address, account name).
  2. Confirm which service holds the data (see the eligibility check).
  3. Run the lookup in that service. The docs site has no lookup.

Export​

Export the data from the service that holds it. The docs site has nothing to export.

Delete​

  1. Delete the identifying data in the service that holds it.
  2. Keep any record that law requires us to keep (for example, billing records).
  3. Confirm completion to the requester. The acknowledgement target is 1 business day. The completion target is 15 days. The legal deadline is 30 days (GDPR Article 12(3)). SigmaShake can extend it by up to 60 days and gives the requester notice if it does. These are targets, not guarantees.

Contact​

Requests go to [email protected].