Privacy & security evaluation brief

Insight with boundaries built in.

A concise overview to share with product, privacy, and security leaders.

Controls at the points data moves.

  1. Consent before the queue.

    The SDK checks an event’s purpose before it enters the offline queue. An event without its purpose granted is dropped. Your app chooses when to grant or revoke purposes; Pharen supplies the enforcement mechanism.

  2. Identity separate from activity.

    The server replaces a supplied user ID with a pseudonymous reference before downstream event storage. Identity attributes are held separately and encrypted. Pseudonymous activity can still be personal data; this design is not a claim of anonymity.

  3. Credential-derived boundaries.

    Organization and environment come from the authenticated credential. A standard ingest key is bound to one app; other allowed app selections are validated. A test build can name a registered test environment, but cannot create one or select live.

  4. Explicit access for agents.

    Query keys are read-only. The metric catalog defines permitted aggregates. Report words require a chosen grant; identity and reporter-contact reads require their own grants and are recorded. Raw events, device-shared locations, health-store data, and individual survey answers are outside query access.

On the query path, Pharen runs no model of its own. Your chosen agent and its provider receive permitted results; evaluate their processing policies separately.

What to verify for your release.

Architecture is one part of the evidence. This brief describes design controls; it does not attest to a deployment, certify compliance, or substitute for current release and operating evidence.

Request release-specific proof.

Use an isolated synthetic test app to confirm consent refusal and revocation, cross-scope refusals, permitted and denied agent reads, and the records those reads produce. Check the installed SDK, server configuration, credential scope, and current test results together.

Review rights handling and retention.

Data-subject requests currently use an operator-led workflow. Automated end-to-end deletion orchestration is not available. Confirm the request process, store coverage, verification evidence, retention, and backup handling for your intended use.

Confirm your integration and access choices.

Review the events and consent purposes your app enables, the identity attributes it supplies, and the grants each agent key carries. Confirm that the intended versions and configuration are running, and review access, key management, and service operations with your reviewers.

Reference pack

Share your evaluation requirements: [email protected].