`docs/CRE_PR_COMPLIANCE.md`

56 lines
# CRE PR Intelligence — Compliance & Data Safety

## Scope of collection
Public **business** information only: organization facts, public work contacts, public
titles, press/media contacts, publicly indexed LinkedIn URLs. Never collected: private
phone numbers, home addresses, birthdays, family details, or any unrelated personal
data. The schema has no columns for such data.

## Access control & audit
- Every route (API + shells) is behind the app's admin role (`adminOnly`), which itself
  sits behind the site's global Basic-Auth gate (double-gated by nginx in prod).
- `pr_audit_log` records every send, edit, approval, status change, merge, import,
  suppression, settings change, and Arizona-gate action with actor + before/after.
- `pr_activities` gives per-record operational history shown in the UI.

## Provenance & honesty
- Every important fact carries `pr_field_evidence` → `pr_sources` (URL, limited excerpt
  ≤600 chars, retrieval date, terms note, content hash). Full copyrighted pages are
  never stored.
- `verification_status` enums are structural: an **inferred** email may be stored but
  can never be marked outreach-eligible (service-level guard + test); a search-indexed
  LinkedIn title is labeled `found_uncorroborated` until corroborated.
- Confidence and priority are separate, always-visible scores with exposed components.

## Outreach compliance (CAN-SPAM aligned)
- Sender identification: `sender_name/title/contact_information/sender_postal_address`
  settings are required before any letter can send (unfilled merge fields visibly block).
- Unsubscribe handling: the `unsubscribe_text` setting renders in letters; any reply
  containing opt-out language immediately writes `pr_suppression` (permanent) and flips
  the thread's status. Permanent opt-outs cannot be deleted from the UI.
- Suppression is enforced at draft-generation, campaign-enrollment, provider-draft, and
  send time (re-checked at each step).
- No purchased lists; contacts originate from public/primary sources or the user's own
  imports with recorded usage notes.
- No open-tracking pixels (none exist in the renderer; none may be added — no approved
  system uses them).

## California privacy (CCPA/CPRA posture)
B2B public business contact data; still, the workspace supports the request workflow:
- **Access/correction:** People page shows every stored field + original extracted
  values; corrections are audited.
- **Deletion:** suppress + archive the person (kept as a suppression tombstone so they
  are never re-contacted); evidence rows can be deleted with the record if demanded.
- **Retention:** `retention_days_sources` / `retention_days_messages` settings (0 = keep)
  are honored by the refresh job sweep and documented for operators.

## Source-terms & rate behavior
- robots.txt honored per host (cached 1h); per-provider minimum-interval throttles;
  declared User-Agent with contact; SEC ≤10 req/s policy respected; FDIC/NCUA are
  public-domain federal data; state-licensing datasets enter only via CSV with per-file
  terms notes; LinkedIn is never scraped (see CRE_PR_DATA_SOURCES.md).

## Secrets
All credentials are environment variables (`.env.example` documents placeholders).
Nothing in source control; the repo's `.gitignore` already excludes `.env*`.