* docs(privacy): name Anthropic in the Bedrock row, state replay deny-by-default
A prospect compared our security claims with a stale published DPA that
listed Anthropic and OpenAI as US processors and read the privacy page's
bare AWS row next to 'delas inte med Anthropic' as a contradiction
(#1674). The in-repo pages were factually right but nothing pinned them
to the code, and the Bedrock row never said whose models run inside it.
- Sub-processor table: the AWS row now states the models are Anthropics
Claude, run entirely inside Amazon Bedrock (eu-north-1, Stockholm),
and that Anthropic is the model vendor, not a sub-processor, and
receives no data. Matches lib/ai/provider.ts: hosted inference is
AnthropicBedrock, default region eu-north-1; no OpenAI code path
exists anywhere.
- PostHog row: the session-replay paragraph now states the
deny-by-default guarantee: masking is the default and cannot be
turned off, every input is masked with no exceptions, untagged new
UI over-masks rather than leaks. Matches instrumentation-client.ts
(maskAllInputs: true, maskTextSelector '*', no maskInputFn) and
lib/analytics/replay-masking.ts.
- New source-content test locks the disclosures to the code so they
cannot drift apart silently: no OpenAI dependency or mention, region
claim equals the provider default, Anthropic named inside the Bedrock
row, DPA keeps /privacy as the single sub-processor list, replay
config still deny-by-default.
The artifact the prospect actually read (published DPA PDF or marketing
security page) lives outside this repo and needs founder/legal action.
Refs #1674
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Emil <emilmattsson14@gmail.com>
* fix(privacy): drop unverifiable underbitraede claim, state only code-provable facts
Adversarial review of the #1674 branch found two overstatements:
1. The Bedrock row asserted 'Anthropic, som ar modelleverantor men inte
underbitraede'. Whether Anthropic is a sub-processor of AWS is a
contractual matter between AWS and Anthropic and cannot be verified
from this repo, and the issue explicitly forbade invented legal
wording. The row now states only what the code shows: AI requests go
to Amazon Bedrock and the models used are Anthropics Claude models
running inside Bedrock. No claim about Anthropics sub-processor
status in either direction. The pre-existing footnote below the
table is untouched (identical to main).
2. The DECISIONS.md entry claimed 'no code path sends data to
Anthropic'. False as a global claim: lib/ai/provider.ts
createAiClient() builds a direct Anthropic API client when
AI_PROVIDER=anthropic or when ANTHROPIC_API_KEY is set without
static AWS keys (the documented self-hosted path), and the region is
process.env.AWS_REGION || 'eu-north-1', a default rather than a
guarantee. The entry now says the hosted posture is Bedrock by
credential precedence, acknowledges the direct API path, and routes
the underbitraede question plus published DPA PDF / marketing page
alignment to founder/legal.
The source-content test now pins the corrected row wording, asserts
the row contains no underbitraede verdict, and no longer cements the
removed sentence.
Refs #1674
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Emil <emilmattsson14@gmail.com>
* test(privacy): track the openai-compatible BYO provider added on main
Signed-off-by: Emil <emilmattsson14@gmail.com>
---------
Signed-off-by: Emil <emilmattsson14@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
