docs(adr): délai de grâce de suppression 30 → 14 jours (ADR-023)#275
Merged
Conversation
The compliance check found what neither the security nor the GDPR audit saw, because both read code and this is a calendar problem. Art. 12(3) gives one month to answer an erasure request. The grace period is 30 days, so the erasure is scheduled at the exact edge of the legal limit — one failed cron run, one long weekend, and it lands late. No rule requires a grace period at all; it is a product courtesy. Fourteen days leaves two weeks of margin and costs nothing anyone has ever asked for. The alternative was to keep 30 and argue that the grace window is not the response window — defensible, but an argument to make to a regulator rather than a problem solved. Deliberately no code: doctrine is decision in session N, implementation in session N+1. And the change only makes sense alongside the cron — moving to 14 days without an executor would just bring forward the date of a promise still not kept. Records three non-code gaps the same check surfaced: backups outlive the deletion and nothing says so, the app has no email capability at all so there is no channel to confirm an erasure to someone whose account no longer exists, and subprocessor logs keep IPs after the fact. Art. 8 is closed: @Thierry confirmed the three third-party account holders are his adult children. Noted in the compliance record too. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Sorry @thierryvm, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
github-actions
Bot
added
status:review-needed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Décision écrite ce soir, exécution demain
Doctrine du projet : une décision d'architecture ne se prend pas dans la même session que son implémentation. Cet ADR ne contient aucune ligne de code.
Ce que le contrôle de conformité a trouvé
L'art. 12(3) donne un mois pour répondre à une demande d'effacement. Le délai de grâce est de 30 jours : la suppression est donc programmée au bord exact de la limite. Une panne de cron, un long week-end, et on est hors délai.
Ni l'audit sécurité ni l'audit RGPD de cette nuit ne l'avaient vu — les deux lisaient du code, et c'est un problème de calendrier.
Aucune règle n'impose un délai de grâce. C'est une courtoisie produit. 14 jours laissent deux semaines de marge et ne coûtent rien que personne n'ait jamais réclamé.
L'alternative était de garder 30 jours en soutenant que la grâce n'est pas le délai de réponse. Défendable — mais c'est un argument à tenir devant une autorité, pas un problème résolu.
Pourquoi pas de code maintenant
Passer à 14 jours sans cron ne ferait qu'avancer la date d'une promesse toujours pas tenue. Le changement part avec l'étape 3b, qui liste ses sept chaînes i18n × 5 locales.
Trois trous non-code, consignés
Refermé
Art. 8 écarté — @Thierry a confirmé que les trois titulaires de comptes tiers sont ses enfants majeurs. Consigné aussi au registre.
AIPD probablement non requise, avec le motif écrit. C'est la trace qui vaut accountability, pas l'absence d'AIPD.