← Package view← Findings

Proof chain · entry node

DA-DONOR-PROFILE

EEP-DONOR-ZA-001 · v1.0.0 · knowledge basis KS-2d4a1d596a27c2e1

Read-mostly. Today the console holds SELECT only, per the grants in 001_packages_and_console.sql and the VAL-CHER-PLANE-001 boundary test.

Holds no authority. It decides nothing, records no approval outcome, and writes nothing to governance, evidence or audit.

proofChainComplete: false - the package's own claim that every mandatory requirement traces to an authority and a validation. It does not claim that every object the package mentions is a node in the graph, and it is not rendered here as the stronger claim.

Declared links, traversed outward from the subject

Each hop is rendered as the package declares it, with its relation type, in traversal order. The chain has no assumed shape: it ends where the links end.

Chain cannot start

The subject DA-DONOR-PROFILE is not a node in this package's declared traceability graph. No link names it on either end, so no chain can be traversed from it.

This is what the package declares, rendered as it stands. It is not an error in the finding and the finding is not omitted for it.

Findings entering here (1)

  • SEM-GEO-002severity CRITICALNON_CONFORMANCE

    personal-information asset is processed in US via 'subprocessor:Transactional email provider' (home jurisdiction ZA) with no cross-border transfer record at all

    Subject
    DA-DONOR-PROFILE
    Location
    dataContract/DA-DONOR-PROFILE/processingGeography/subprocessor:Transactional email provider