Data Security and Compliance

Data, Security & Compliance Notes

What this package contains

Model definitions. No data, no credentials, no endpoints with secrets. The published archive is a schema description; installing it creates empty tables.

What lands in the models once loading starts

Whatever the enabled Plex endpoints return. That routinely includes:

• Personal data — plexUserAccount carries names, email addresses, department and position. createdById and modifiedById on 76 references point at it.
• Commercial terms — supplier and customer pricing, invoices, purchase orders.
• The verbatim vendor payload — rawPayload on every row stores exactly what Plex returned, including any field the model does not otherwise promote.

rawPayload deserves a decision rather than a default. It is there so a suspect field can be traced to the response that produced it, and so a vendor schema change is visible in the data. It also means anything Plex returns is retained, whether or not the schema names it. If your data-protection position does not allow that, drop the column or stop populating it — but do so knowingly.

Data residency

Rows live in the Fuuz tenant they are loaded into. Raw payloads stay in the spoke tenant by design; only derived feature bundles are intended to cross to an enterprise hub. That boundary is a design intent of the keyring, not something this package enforces on its own.

Credentials

None are included or implied. The Plex API connection is a separate Connection record holding the credentials, created by the implementing site. Credentials must live in the connection record, never in a flow, a model, or configuration.

Attribution and audit

Every row records where it came from and when: sourceSystemId (an enforced reference to a registered ExternalSystem), sourceUrl, sourceVersion, syncedAt. sourceSystemId being a real relation rather than a free-text id is what makes a mistyped source system a rejected write rather than a discovery months later.

Data change capture is enabled on every model with 120-day retention, so changes to landed rows are attributable and timestamped.

What this package does not do

It does not configure access control, does not define roles, and does not restrict which users can read which models. Those are tenant-level concerns and must be set separately — installing this package makes 182 models readable to anyone who can already read the tenant.