B2B Security, GDPR Art. 17 Erasure & Data-Minimization Compliance Guide
Enterprise procurement, DPOs, and CISO teams require verifiable proof of what touches disk before approving a Stripe or Shopify Plus B2B integration. RevClamp Enterprise enforces a strict Zero-Trust Field-Level Edge Allowlist: raw card numbers, CVCs, AI prompts/completions, session cookies, and private keys are stripped in memory prior to persistence, all operational logs expire automatically on a 90-day rolling TTL, and mandatory privacy webhooks (customers/redact, shop/redact, customer.deleted) commit an irreversible SHA-256 cryptographic tombstone within <= 1s.
1. Field-Level Edge Allowlist vs. Stripped Sensitive Payloads
Every incoming webhook and usage ingestion request (POST /v1/events/ingest, POST /api/mcp, and Shopify/Stripe webhooks) passes through an allowlist normalizer that retains only quantitative B2B billing and tax identifiers.
| Pipeline Domain | Admitted Quantitative Fields | Stripped / Blocked Sensitive Fields | Retention & Erasure SLA |
|---|---|---|---|
| 1. Stripe Entitlement & Usage Telemetry | stripe_customer_id, event_name, units, occurredAtSec |
Raw AI prompts, LLM completions, request bodies, bearer tokens, session cookies | 90-day rolling TTL; instant purge on customer.deleted (<= 1s) |
| 2. Visa CE 3.0 & First-Party Usage Logs | disputeId, customer_id, 128-bit IP subnet digest, device hash, timestamps |
PAN / card numbers, CVC, bank routing numbers, customer passwords | Staged with submit: false; purged on dispute closure or 90-day TTL |
| 3. EU & XI VIES VAT Consultation Vault | Normalized 28-prefix vatId (GR -> EL), requestIdentifier, SHA-256 seal |
Personal national ID numbers, residential addresses, unmasked buyer phone numbers | Quarterly CSV export + instant purge on shop/redact |
| 4. Shopify Plus B2B Net-15/30/60 Ledger | orderId, integer EUR cents (totalOrderCents, paidAmountCents, creditNoteCents) |
Payment card tokens, buyer browser fingerprints, marketing tracking pixels | Instant tombstone on customers/redact & shop/redact |
| 5. Dual-Rail Billing & Workspace Auth | tenantId, masked key suffix (rg_live_****), EVM txHash, plan tier |
Raw cardholder data (handled 100% by Lemon Squeezy MoR), private keys (LIVE_SECRET_GUARD_RE) |
Immediate key revocation on rotation; zero raw key exposure on GET /api/dashboard/billing-status |
2. GDPR Art. 17 & Shopify Redact Tombstone + Field-Filter Verifier (POST /api/tools/gdpr-erasure-preview)
Simulate a Shopify customers/redact, shop/redact, or Stripe customer.deleted erasure event and inspect how RevClamp strips non-allowlisted fields and computes a deterministic SHA-256 erasure tombstone without retaining PII.
{
"ok": true,
"webhookTopic": "shopify_customers_redact",
"subjectIdentifier": "cust_shopify_b2b_8841",
"tombstoneSha256": "e8c4c30248292488e77f7d5b1a749697b1e7b8097c46f836486049e919263868",
"tombstoneStatus": "TOMBSTONE_PREVIEW_ONLY",
"tablesPurged": [
"tenant_usage_events",
"dispute_staged_drafts",
"vies_consultations"
],
"admittedFields": [
"stripe_customer_id",
"event_name",
"units",
"occurredAtSec",
"vatId"
],
"droppedSensitiveFields": [
"card_number",
"cvc",
"raw_prompt",
"session_cookie",
"private_key"
],
"retainedPiiBytes": 0,
"rollingTtlDays": 90,
"erasureSlaSeconds": 1,
"complianceFrameworks": [
"GDPR Art. 17 Right to Erasure",
"Shopify Mandatory Privacy Webhooks",
"PCI-DSS Zero Cardholder Data Storage"
]
}