Data Flow Properties

Source models: DataFlowEngineering, DataFlowPrivacy, DataFlowSecurity, and DataFlowProperties in code.

Engineering

description

• Type: string
• Description: Description of what is happening in this transfer
• Example: "Syncs newly created customer accounts from app backend to CRM"

transferType

• Type: DataFlowType
• Description: Type of transfer mechanism
• Example: "api_call"

frequency

• Type: string
• Description: Frequency of transfer (e.g., ‘Daily’, ‘Weekly’, ‘On-demand’)
• Example: "Continuous streaming during active sessions"

volumeEstimate

• Type: string
• Description: Estimated volume of data transferred (e.g., ‘1000 records/day’)
• Example: "~250,000 events/day (~4 GB/day)"

batchSize

• Type: string
• Description: Batch size for transfer
• Example: "500 records per batch"

retryPolicy

• Type: string
• Description: Retry policy details
• Example: "3 retries with exponential backoff (5s, 15s, 45s)"

errorHandling

• Type: string
• Description: Error handling strategy
• Example: "Dead-letter queue + alert to on-call + replay after fix"

timeout

• Type: string
• Description: Timeout configuration
• Example: "30 seconds request timeout"

name

• Type: string
• Description: Name of the transfer
• Example: "Customer Signup -> CRM Sync"

actions

• Type: string[]
• Description: Operations/actions performed
• Example: ["validate", "transform", "enrich", "store"]

protocol

• Type: string
• Description: Protocol used
• Example: "HTTPS REST"

dataFormat

• Type: string[]
• Description: Data formats
• Example: ["JSON", "CSV"]

Privacy

dataCategories

• Type: string[]
• Description: Categories of personal data transferred
• Example: ["Contact details", "Account identifiers", "Usage metadata"]

dataSubjectCategories

• Type: string[]
• Description: Categories of data subjects
• Example: ["Customers", "Prospective customers"]

dataSubjects

• Type: string[]
• Description: Categories of data subjects
• Example: ["Customers"]

frequency

• Type: string
• Description: Frequency of the transfer (e.g., ‘real-time’, ‘daily’, ‘weekly’, ‘on-demand’)
• Example: "Continuous streaming during active sessions"

legalBasis

• Type: string
• Description: GDPR legal basis for the transfer (e.g., ‘consent’, ‘contract’, ‘legal obligation’)
• Example: "Contract performance"

processingPurpose

• Type: string[]
• Description: Processing purpose
• Example: ["Account provisioning", "Customer support", "Fraud prevention"]

crossBorder

• Type: boolean
• Description: Whether this is a cross-border data transfer
• Example: true

thirdCountry

• Type: string
• Description: Name of the third country if cross-border transfer
• Example: "United States"

adequacyDecision

• Type: boolean
• Description: Whether the destination country has an adequacy decision from the EU
• Example: false

safeguards

• Type: string
• Description: Description of safeguards in place for cross-border transfers
• Example: "SCCs in contract, encryption in transit, and vendor subprocessor controls"

transferSafeguards

• Type: string
• Description: Selected transfer safeguards
• Example: "SCC"

Security

encryption

• Type: EncryptionType
• Description: Type of encryption used during transfer
• Example: "tls_1_2_or_higher"

encryptionInTransit

• Type: EncryptionType
• Description: Canonical field for encryption in transit
• Example: "tls_1_3"

transformation

• Type: DataTransformation
• Description: Type of data transformation applied during transfer
• Example: "tokenization"

accessControls

• Type: string
• Description: Description of access controls applied to the transfer
• Example: "Service account only, IAM role-bound, source IP allowlist"

authenticationMethod

• Type: string
• Description: Authentication method
• Example: "mTLS + signed JWT"

dataIntegrityVerification

• Type: string
• Description: Data integrity verification
• Example: "SHA-256 checksum with signature verification"

auditLogging

• Type: boolean
• Description: Whether audit logging is enabled for this transfer
• Example: true

dataRetention

• Type: string
• Description: Data retention period or policy for transferred data
• Example: "Payloads retained 7 days in staging; logs retained 180 days"

riskLevel

• Type: RiskLevel
• Description: Risk level assessment for this transfer
• Example: "medium"

riskLevelComputed

• Type: RiskLevel
• Description: Computed risk level
• Example: "high"

riskLevelOverride

• Type: RiskLevel
• Description: Override risk level
• Example: "medium"

riskLevelOverrideReason

• Type: string
• Description: Override reason
• Example: "Compensating controls validated in last penetration test"

riskNotes

• Type: string
• Description: Additional notes or details about the risk assessment
• Example: "Residual risk accepted pending Q3 migration to private connectivity"

Container-Level Fields

targetScope

• Type: 'local' | 'cross_section_internal' | 'external' | 'unknown'
• Description: Classification of where the target endpoint sits relative to the current system boundary.
• Example: "external"

targetScopeConfidence

• Type: 'high' | 'medium' | 'low'
• Description: Confidence level for the targetScope classification.
• Example: "high"

targetScopeReason

• Type: string
• Description: Evidence or rationale supporting the chosen target scope classification.
• Example: "Destination is a vendor-managed API endpoint outside company network"