watchtower-observability-stack/docs/gdpr-compliance.md

GDPR Compliance

This stack processes telemetry that is likely to contain personal data (IPs, user IDs, request bodies, emails). The deployment is hosted by Hetzner in Nuremberg, Germany — all data stays within the EU.

Roles

• Data Controller: the operator deploying this stack.
• Data Processor (infrastructure): Hetzner Online GmbH (DE).
• Sub-processors: none by default.

Legal basis (Art. 6)

Document the basis for each tenant under docs/gdpr-compliance.md (per-tenant section to be filled in). Typical bases:

• Art. 6(1)(f) legitimate interest — operational logging.
• Art. 6(1)(b) contract performance — telemetry necessary to deliver service.

Required documents

Document	Status	Notes
Data Processing Agreement with Hetzner	sign in Cloud Console	required Art. 28
Record of Processing Activities (RoPA)	template below	required Art. 30
Data Protection Impact Assessment (DPIA)	required	Art. 35 — high-risk processing
Breach response runbook	docs/runbook.md	Art. 33/34

Data residency

All telemetry buckets live in nbg1 (Hetzner, Nuremberg). The OpenTofu state lives in Cloudflare R2 — operators must configure R2 to use only EU jurisdictions (Jurisdiction: EU) when creating the state bucket, otherwise state metadata may be replicated outside the EU.

Retention register

Signal	Application Retention	Bucket Lifecycle	Effective Erasure Window
Logs	30 days (Loki)	90 days (S3 lifecycle)	30 days (compactor)
Metrics	90 days (Mimir)	365 days (S3 lifecycle)	90 days (compactor)
Traces	14 days (Tempo)	30 days (S3 lifecycle)	14 days (compactor)

Bucket-level lifecycle is a safety net — application-level retention is the primary erasure mechanism. The wider lifecycle window allows application-level rollback in case of a misconfiguration.

PII minimization

Collector-side scrubbing

Clients run Grafana Alloy with the redaction pipeline at config/alloy/config.alloy.example. Patterns redacted:

• IPv4 / IPv6 addresses → [REDACTED-IP*]
• Email addresses → [REDACTED-EMAIL]
• JWT tokens → [REDACTED-JWT]
• Bearer tokens in Authorization headers → [REDACTED-TOKEN]
• Card numbers (PAN, 13–19 digits) → [REDACTED-PAN]
• UUIDs → [REDACTED-UUID]
• Lines containing password=, ssn=, cvv=, cvc= → dropped

OTLP attribute scrubbing

The otelcol.processor.attributes block hashes/deletes these attributes before traces reach Tempo:

Attribute	Action
enduser.id	hashed (correlatable but not reversible)
user.email	deleted
client.address	deleted
http.request.header.authorization	deleted
http.request.header.cookie	deleted
http.request.body	deleted

Label / cardinality discipline

Mimir and Tempo do not support per-record deletion. To stay compliant, no PII may ever appear in metric labels or trace resource attributes. Tenants must use opaque identifiers (UUIDs hashed at the collector, opaque session IDs) — never emails, names, or phone numbers as label values.

Right to erasure (Art. 17)

Signal	Mechanism	RTO
Logs	Loki Delete API via playbooks/gdpr-purge.yml	hours
Metrics	Retention only — short window + label discipline	≤90 days
Traces	Retention only — 14-day window	≤14 days

Document each erasure in /var/log/observability/gdpr-audit.log (the playbook appends automatically). Notify the data subject within one month per Art. 12(3).

Encryption

Layer	Mechanism
In transit (client → server)	WireGuard (ChaCha20-Poly1305)
In transit (server → S3)	TLS 1.2+
At rest (local WAL/Grafana DB)	LUKS2
At rest (S3)	Hetzner SSE

Access control & audit

• WireGuard: each peer has its own key; revoke by removing from wg0.conf.
• Host firewall: nftables with default-drop input policy. Service ports are bound to 10.8.0.1 (wg0) and unreachable on the public interface. SSH and WireGuard are restricted to administrator CIDRs (admin_allow_ipv4 / admin_allow_ipv6) and rate-limited at the kernel.
• fail2ban: brute-force defense for SSH (jail sshd) plus a recidive jail that long-bans repeat offenders. Bans are enforced via fail2ban's own nftables table (inet f2b-table).
• Grafana: [auditing] enabled — all dashboard / API actions logged to /var/log/grafana/audit.log with rotation.
• SSH: ed25519 keys only, root password auth disabled.
• Tenant isolation: enforced by X-Scope-OrgID at Mimir/Loki/Tempo plus Grafana Org RBAC.

Breach response (Art. 33/34)

72-hour notification to the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) — Bavaria's supervisory authority. Procedure documented in docs/runbook.md § Breach Response.

RoPA template

For each tenant, fill in:

• Name & contact of controller
• Categories of data subjects
• Categories of personal data processed in telemetry
• Recipients (none — internal only)
• Transfers outside EEA (none)
• Retention periods (per signal — see above)
• Technical & organisational measures (this document)