GDPR & data security: what happens to your context

Ask every process documentation solution four questions: Where does the data live? Who has access? What is stored — and what is only processed? And does the source stay with you? A context-based engine builds from what you already have instead of migrating it into a new silo — the living context stays your source, verifiable through a DPA and a disclosed processing path, not asserted.

Process documentation means knowledge about your company leaves people’s heads and lands in a system. For CISOs and data protection officers, that’s the decisive question — not whether a tool draws pretty diagrams, but what happens to the context that flows in. Instead of promising you assurances every vendor claims, here are the questions you should ask — and how Forge answers them in principle.

What questions should you ask any process documentation solution?

Where does the data live? Hosting location and legal jurisdiction determine which supervisory authority you fall under. Have it shown to you concretely — including the sub-processors — and don’t settle for a logo.

Who has access? Not just your people, but the vendor and its service providers too. Is there a data processing agreement (DPA)? Is processing done only on your instructions?

What is stored — and what is only processed? There’s a difference between a system that hoards your content permanently and one that only lets it pass through to build a result. Ask about retention periods and deletion paths.

Does the source stay with you? Does the tool force a migration into its own data lake — or does your system (Confluence, SharePoint, the heads) remain the authoritative source?

How a context-based engine handles this

Forge builds artifacts from what you already have — not from a new silo. The living context stays your source; the engine reads it, understands it, and shapes the result that’s due now. There’s no forced migration into someone else’s data lake, because the principle isn’t “absorb everything” but “build from your existing material”.

That includes data minimization: anything the artifact doesn’t need has no business in the processing path. Whoever works with you should be able to present DPAs, disclose the hosting and processing path, and cleanly separate storage from processing steps — verifiable, not asserted.

The honest answer isn’t a certificate on the wall — it’s a processing path your data protection officer can actually follow.

That’s exactly what a demo can walk through: your stack, your data flows, your questions — and where the context sits at every step.