docs(privacy): name Anthropic in the Bedrock row, state replay deny-by-default, pin disclosures to code (#1766)

* docs(privacy): name Anthropic in the Bedrock row, state replay deny-by-default A prospect compared our security claims with a stale published DPA that listed Anthropic and OpenAI as US processors and read the privacy page's bare AWS row next to 'delas inte med Anthropic' as a contradiction (#1674). The in-repo pages were factually right but nothing pinned them to the code, and the Bedrock row never said whose models run inside it. - Sub-processor table: the AWS row now states the models are Anthropics Claude, run entirely inside Amazon Bedrock (eu-north-1, Stockholm), and that Anthropic is the model vendor, not a sub-processor, and receives no data. Matches lib/ai/provider.ts: hosted inference is AnthropicBedrock, default region eu-north-1; no OpenAI code path exists anywhere. - PostHog row: the session-replay paragraph now states the deny-by-default guarantee: masking is the default and cannot be turned off, every input is masked with no exceptions, untagged new UI over-masks rather than leaks. Matches instrumentation-client.ts (maskAllInputs: true, maskTextSelector '*', no maskInputFn) and lib/analytics/replay-masking.ts. - New source-content test locks the disclosures to the code so they cannot drift apart silently: no OpenAI dependency or mention, region claim equals the provider default, Anthropic named inside the Bedrock row, DPA keeps /privacy as the single sub-processor list, replay config still deny-by-default. The artifact the prospect actually read (published DPA PDF or marketing security page) lives outside this repo and needs founder/legal action. Refs #1674 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Emil <emilmattsson14@gmail.com> * fix(privacy): drop unverifiable underbitraede claim, state only code-provable facts Adversarial review of the #1674 branch found two overstatements: 1. The Bedrock row asserted 'Anthropic, som ar modelleverantor men inte underbitraede'. Whether Anthropic is a sub-processor of AWS is a contractual matter between AWS and Anthropic and cannot be verified from this repo, and the issue explicitly forbade invented legal wording. The row now states only what the code shows: AI requests go to Amazon Bedrock and the models used are Anthropics Claude models running inside Bedrock. No claim about Anthropics sub-processor status in either direction. The pre-existing footnote below the table is untouched (identical to main). 2. The DECISIONS.md entry claimed 'no code path sends data to Anthropic'. False as a global claim: lib/ai/provider.ts createAiClient() builds a direct Anthropic API client when AI_PROVIDER=anthropic or when ANTHROPIC_API_KEY is set without static AWS keys (the documented self-hosted path), and the region is process.env.AWS_REGION || 'eu-north-1', a default rather than a guarantee. The entry now says the hosted posture is Bedrock by credential precedence, acknowledges the direct API path, and routes the underbitraede question plus published DPA PDF / marketing page alignment to founder/legal. The source-content test now pins the corrected row wording, asserts the row contains no underbitraede verdict, and no longer cements the removed sentence. Refs #1674 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Emil <emilmattsson14@gmail.com> * test(privacy): track the openai-compatible BYO provider added on main Signed-off-by: Emil <emilmattsson14@gmail.com> --------- Signed-off-by: Emil <emilmattsson14@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-20 21:36:47 +02:00
parent 72181e49bd
commit 577552ca94
3 changed files with 164 additions and 9 deletions
@@ -1132,3 +1132,5 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-08-19] undo_bank_file_import (#1672) skips unbooked rows carrying payment_match_log history instead of weakening the audit_log_immutable delete guard: the log is append-only räkenskapsinformation (BFL 7 kap) per 20260323120000 ("Do NOT add cleanup/DELETE jobs") and the single-row DELETE route already refuses those rows (TRANSACTION_DELETE_HAS_AUDIT_TRAIL); the undo reports skipped_match_history so the user can ignore the stragglers. Rejected: a scoped trigger bypass like the GDPR account-delete RPC uses (erasure is a legal right overriding retention; an import undo is not).
 [2026-08-19] transactions.bank_file_import_id has NO retroactive backfill: attribution by (format, date window) can mislink rows to the wrong batch when a company has several same-format imports, and "undo this import" must never delete rows from a different one. Imports executed before 20260820071500 are simply not undoable through this action.
 [2026-08-19] Sidebar company switch (#1664): reinstated the existing CompanySwitcher at the top of the expanded desktop sidebar instead of turning the logo slot into the switcher (the issue offered both); the logo keeps its home link plus a native title tooltip, the user-menu flyout stays as the secondary path, and the collapsed rail relies on the UserMenu avatar since 64px has no room for a labeled switcher.
+[2026-08-19] #1674 audit fixed the in-repo disclosures only (privacy sub-processor Bedrock row now names Anthropic as model vendor, replay paragraph states the deny-by-default guarantee, both locked by app/(public)/privacy/__tests__): Anthropic was deliberately NOT added as its own sub-processor row because no code path sends data to Anthropic (hosted uses Bedrock in eu-north-1, lib/ai/provider.ts); the artifact the prospect actually read (published DPA PDF or marketing security page listing Anthropic/OpenAI in the US) lives outside this repo and needs founder/legal action, as does any underbitraede-list wording.
+[2026-08-19] #1674 audit fixed the in-repo disclosures only (privacy sub-processor Bedrock row now says AI requests go to Amazon Bedrock and the models are Anthropics Claude running inside Bedrock, replay paragraph states the deny-by-default guarantee, both locked by app/(public)/privacy/__tests__): Anthropic was not added as its own sub-processor row because the HOSTED posture is Bedrock by credential precedence (lib/ai/provider.ts: static AWS keys select Bedrock, region is AWS_REGION with eu-north-1 as the default, not a guarantee); a direct Anthropic API path DOES exist in code for self-hosted deployments (AI_PROVIDER=anthropic, or ANTHROPIC_API_KEY without static AWS keys), so "no code path sends data to Anthropic" would be false and the page asserts nothing about Anthropics underbitraede status either way; whether Anthropic is an underbitraede, plus aligning the published DPA PDF / marketing security page (which listed Anthropic/OpenAI in the US), is founder/legal action outside this repo.