Privacy-First Practices #2: Regular Privacy Audits

## Data Collection
- [ ] Documented: What data is collected?
- [ ] Documented: Why each field is necessary?
- [ ] Verified: Minimal data collection practiced?
- [ ] Verified: User consent obtained before collection?
- [ ] Verified: Collection points logged and monitored?

## Data Storage
- [ ] Verified: Encryption at rest (AES-256)?
- [ ] Verified: Database access controls configured?
- [ ] Verified: Backup encryption enabled?
- [ ] Documented: Data location (region/jurisdiction)?
- [ ] Verified: Storage limits/quotas enforced?

## Data Transmission
- [ ] Verified: TLS 1.3 enforced everywhere?
- [ ] Verified: No plaintext transmission of sensitive data?
- [ ] Verified: Certificate validity and pinning?
- [ ] Tested: Downgrade attacks prevented?

## Data Access
- [ ] Verified: Role-based access control (RBAC)?
- [ ] Verified: Principle of least privilege applied?
- [ ] Verified: Access logging enabled?
- [ ] Verified: Admin access requires MFA?
- [ ] Tested: Unauthorized access properly blocked?

## Data Deletion
- [ ] Verified: Automated retention policies active?
- [ ] Verified: User deletion requests processed (< 30 days)?
- [ ] Verified: Data actually deleted (not just marked deleted)?
- [ ] Verified: Backups also purged after retention?
- [ ] Tested: Deletion process actually works?

## Third Parties
- [ ] Documented: All third-party data processors?
- [ ] Verified: Data Processing Agreements (DPAs) signed?
- [ ] Verified: Third-party security assessments done?
- [ ] Verified: Minimal data shared with third parties?
- [ ] Tested: Third-party data access can be revoked?

// Automated policy compliance checker
class PolicyComplianceAuditor {
  async auditDataRetention() {
    // Check: Are we keeping data longer than policy states?
    const policy = await getRetentionPolicy();
    const violations = [];

    for (const dataType of policy.dataTypes) {
      const oldestRecord = await db[dataType.table].findFirst({
        orderBy: { createdAt: 'asc' }
      });

      const age = Date.now() - oldestRecord.createdAt.getTime();
      const maxAge = dataType.retentionDays * 24 * 60 * 60 * 1000;

      if (age > maxAge) {
        violations.push({
          type: dataType.name,
          policyDays: dataType.retentionDays,
          actualDays: Math.floor(age / (24 * 60 * 60 * 1000)),
          severity: 'HIGH'
        });
      }
    }

    return violations;
  }

  async auditThirdPartySharing() {
    // Check: Are we sharing data with undisclosed parties?
    const privacyPolicy = await getPrivacyPolicy();
    const disclosedVendors = privacyPolicy.thirdParties.map(t => t.name);

    const actualIntegrations = await getActiveIntegrations();
    const violations = actualIntegrations.filter(
      integration => !disclosedVendors.includes(integration.vendor)
    );

    return violations.map(v => ({
      vendor: v.vendor,
      dataShared: v.dataTypes,
      severity: 'CRITICAL'
    }));
  }
}

// User rights compliance audit
class UserRightsAuditor {
  async auditRightToAccess() {
    // Can users actually export their data?
    const testUserId = 'audit-test-user';
    try {
      const export = await exportUserData(testUserId);
      return {
        compliant: export !== null && export.size > 0,
        responseTime: measureResponseTime()
      };
    } catch (error) {
      return { compliant: false, error: error.message };
    }
  }

  async auditRightToDeletion() {
    // Are deletion requests processed within 30 days?
    const deletionRequests = await db.deletionRequest.findMany({
      where: {
        status: 'pending',
        createdAt: {
          lt: new Date(Date.now() - 30 * 24 * 60 * 60 * 1000)
        }
      }
    });

    return {
      compliant: deletionRequests.length === 0,
      overdueRequests: deletionRequests.length,
      oldestRequest: deletionRequests[0]?.createdAt
    };
  }

  async auditRightToRectification() {
    // Can users update their own data?
    // Test that user-facing update APIs work
  }
}

#!/bin/bash
# Security audit with privacy focus

echo "=== Privacy-Focused Security Audit ==="

# Check encryption at rest
echo "✓ Checking database encryption..."
sqlite3 app.db "PRAGMA cipher_version;" || echo "❌ Database not encrypted!"

# Check TLS configuration
echo "✓ Checking TLS configuration..."
nmap --script ssl-enum-ciphers -p 443 yourdomain.com | grep -E "TLSv1\.[23]"

# Check for exposed secrets
echo "✓ Scanning for exposed secrets..."
truffleHog --regex --entropy=True .

# Check access logs for unauthorized access
echo "✓ Analyzing access logs..."
grep "401\|403" /var/log/nginx/access.log | tail -20

# Check third-party scripts
echo "✓ Auditing third-party scripts..."
curl -s https://yourdomain.com | grep -oP 'src="\K[^"]+' | grep -v "yourdomain.com"

// Continuous privacy monitoring
class PrivacyMonitor {
  async runDailyChecks() {
    const results = {
      date: new Date(),
      checks: []
    };

    // Check 1: No sensitive data in logs
    results.checks.push(
      await this.checkLogsForPII()
    );

    // Check 2: Encryption enabled
    results.checks.push(
      await this.verifyEncryption()
    );

    // Check 3: Access control working
    results.checks.push(
      await this.testAccessControl()
    );

    // Check 4: Retention policies enforced
    results.checks.push(
      await this.verifyRetention()
    );

    // Check 5: Third-party compliance
    results.checks.push(
      await this.auditThirdParties()
    );

    // Alert on failures
    const failures = results.checks.filter(c => !c.passed);
    if (failures.length > 0) {
      await this.sendAlert(failures);
    }

    // Log results
    await db.auditLog.create({ data: results });

    return results;
  }

  async checkLogsForPII() {
    // Scan recent logs for email addresses, SSNs, credit cards
    const piiPatterns = [
      /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/,
      /\b\d{3}-\d{2}-\d{4}\b/,
      /\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/
    ];

    const logs = await getRecentLogs();
    const violations = [];

    for (const log of logs) {
      for (const pattern of piiPatterns) {
        if (pattern.test(log.message)) {
          violations.push({
            logId: log.id,
            pattern: pattern.toString(),
            timestamp: log.timestamp
          });
        }
      }
    }

    return {
      name: 'PII in Logs Check',
      passed: violations.length === 0,
      violations
    };
  }
}

// Run daily
cron.schedule('0 3 * * *', async () => {
  const monitor = new PrivacyMonitor();
  await monitor.runDailyChecks();
});

# Privacy Audit Report
**Date:** 2025-11-10
**Auditor:** [Name]
**Scope:** [What was audited]

## Executive Summary
- Overall Status: [Green/Yellow/Red]
- Critical Issues: [Number]
- High Priority: [Number]
- Recommendations: [Number]

## Findings

### Critical Issues
1. **[Issue Title]**
   - **Risk:** [Description of privacy risk]
   - **Evidence:** [What was found]
   - **Impact:** [Who is affected, how severely]
   - **Recommendation:** [How to fix]
   - **Timeline:** [When to fix by]

### High Priority Issues
[Similar format]

### Medium Priority Issues
[Similar format]

## Positive Findings
- [Things done well]
- [Areas of compliance]

## Metrics
- Data types collected: [Number]
- Third-party processors: [Number]
- Average deletion request time: [Days]
- Encryption coverage: [Percentage]
- Access control compliance: [Percentage]

## Recommendations
1. **Immediate Actions** (0-30 days)
2. **Short-term Improvements** (1-3 months)
3. **Long-term Initiatives** (3-12 months)

## Follow-up
Next audit date: [Date]
Responsible parties: [Names]