Privacy

PII pre-scrub on ingestion: dict-grow nightly cron scrubs email / phone / SSN / national ID patterns from miss candidates before LLM call. Per GDPR Art. 5 §1(c) data minimization.

No PII in /healthz: public-facing health endpoint returns numeric counts only (Redis keys, canonical entries, latency percentiles). No customer data, no per-IP statistics, no query logs.

Audit trail on dict-grow auto-approval: each auto-approved entry stores _source / _model / _approved_at / _similarity for traceability + future deletion requests.

Retention: 30 days for pending miss queue, 90 days for translated entries, $10/night LLM budget cap (rate limit 10/hr per IP).