GDPR Compliance

Traditional approaches to GDPR compliance rely on access controls, organizational policies, and periodic audits. These measures create a gap between what an organization claims it does with personal data and what it actually does. H33 eliminates this gap by making GDPR compliance a property of the cryptographic system itself.

When personal data enters H33's pipeline, it is immediately encrypted using Fully Homomorphic Encryption (FHE). From that point forward, all processing occurs on ciphertext. The H33 infrastructure never sees, stores, or logs plaintext personal data. This is not an access control policy that can be circumvented by an administrator -- it is a mathematical property of the encryption scheme. An insider threat, a compromised server, or a stolen backup yields only ciphertexts that are computationally infeasible to decrypt without the client-held key.

Every data processing operation generates a post-quantum signed attestation through H33-74, H33's 74-byte attestation standard. These attestations create a tamper-proof, cryptographically verifiable record of every action taken on personal data: when it was processed, what operation was performed, and what the result was. This chain of attestations serves as the technical foundation for GDPR accountability requirements, providing evidence that is independently verifiable by any third party without trusting H33 infrastructure.

H33 uses three independent post-quantum signature families for all attestations and data protection: ML-DSA-65 (NIST FIPS 204, lattice-based), FALCON-512 (NTRU lattice-based), and SLH-DSA-SHA2-128f (stateless hash-based). Protection breaks only if MLWE lattices, NTRU lattices, AND stateless hash functions are simultaneously compromised -- three independent mathematical hardness assumptions. This ensures that personal data protection remains intact even against future quantum computing capabilities, a critical consideration given GDPR's implicit requirement that data protection measures remain effective for the foreseeable future.

Data Minimization

H33's FHE pipeline processes only the encrypted data necessary for the requested computation. The system does not retain intermediate values, logs, or metadata beyond what is required for the current operation. Because processing occurs on ciphertext, even the data that is retained is mathematically unintelligible without the client-controlled decryption key. The H33 Privacy Layer enforces these boundaries at the protocol level: the system cannot retain more data than the cryptographic protocol permits.

Integrity and Confidentiality

Every processing operation produces a post-quantum signed attestation that cryptographically binds the input, output, and operation together. This attestation chain provides a mathematical guarantee of data integrity that is independently verifiable without trusting H33 infrastructure. Confidentiality is enforced by FHE: data remains encrypted throughout the entire processing pipeline, and H33 infrastructure never has access to decryption keys.

Accountability

H33-74 attestations create an immutable, cryptographically verifiable record of every data processing event. These records satisfy GDPR's accountability principle by providing evidence that is stronger than traditional audit logs: each attestation is post-quantum signed, timestamped, and chained to previous operations, making retroactive modification computationally infeasible. Regulators, auditors, and data subjects can independently verify these records using H33's open verification standard.

What the endpoint does today. A signed-in customer can send an erasure request to the account-delete endpoint. It confirms the customer's identity with the identity service, requires an explicit confirmation, and records the request in the audit log. It then refuses to delete anything and returns "deleted": false with a plain statement that the account is unchanged. It does not revoke sessions, remove records, shred keys or produce an attestation. A partial deletion would leave identity and account data inconsistent, so the endpoint refuses rather than half-completes.

Why. Customer accounts and sessions are owned by H33's identity service (Auth1). Deletion is being implemented there as a single operation covering identity verification, step-up confirmation, session revocation, account deletion or deactivation, durable audit evidence, handling of partial failures, and any legally required retention. Until that operation is qualified, no deletion is presented as complete. For an erasure request in the meantime, use the contact page.

Design objective, not yet operational. The intended design shreds the encryption keys associated with a data subject, so that ciphertext fragments left in backups or caches cannot be decrypted. It also issues a tombstone record, signed with post-quantum signatures, as evidence that the deletion happened and when. That record would contain no personal data. None of this is available today, and this page should not be read as evidence that any erasure has occurred.

H33's profile-update endpoint allows data subjects (or their authorized controllers) to modify personal data while maintaining a complete, tamper-proof chain of custody. When a rectification request is processed, the system generates a new H33-74 attestation that cryptographically links the previous state, the rectification request, and the new state into a single verifiable record.

This approach provides several GDPR-specific benefits. First, it creates an auditable record that the rectification was performed, satisfying accountability requirements. Second, the cryptographic chain ensures that the rectification cannot be silently reverted -- any modification to the chain would invalidate all subsequent attestations. Third, the previous state is cryptographically superseded but remains available for dispute resolution if needed, with access governed by the data controller's key management policy.

For organizations processing personal data through H33's FHE pipeline, rectification operates on encrypted data. The data controller submits the corrected data (encrypted under their FHE key), and H33's infrastructure replaces the encrypted record without ever seeing the plaintext content. The attestation chain records that a rectification occurred, when, and by whose authority, without revealing the actual data values.

H33's dsar-export endpoint generates a comprehensive, machine-readable export package containing all personal data associated with a data subject. The export includes the data itself (encrypted under the requesting party's key), a complete chain of all processing attestations, metadata about each processing operation (purpose, legal basis, timestamp), and a manifest signed by all three post-quantum signature families.

The DSAR export is designed to satisfy Article 15's requirements comprehensively. It includes not just the personal data, but information about the purposes of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making. Each piece of information in the export is individually attested by H33-74, creating a package that the data subject can independently verify for completeness and integrity.

For organizations handling high volumes of DSARs, H33's API supports batch processing with configurable export formats (JSON, CSV, PDF) and automated delivery via webhook. Response times are governed by H33's H33-74 attestation pipeline, which processes attestations at microsecond latency, making even complex DSAR exports available in seconds rather than the days or weeks typical of manual DSAR processes.

Fully Homomorphic Encryption (FHE) is the strongest possible implementation of data protection by design. With FHE, personal data is encrypted before it enters the processing pipeline, and all computation occurs directly on the ciphertext. The system produces encrypted results that only the data controller can decrypt. At no point does H33 infrastructure, any H33 employee, any operating system process, or any hardware component ever access plaintext personal data.

This is fundamentally different from traditional encryption-at-rest or encryption-in-transit approaches, which decrypt data for processing. In those systems, personal data exists in plaintext in memory during computation -- creating a window of vulnerability that insider threats, memory-scraping malware, or side-channel attacks can exploit. H33's FHE approach closes this window entirely. The data is never decrypted during processing. Period.

H33 provides four FHE engine tiers to match different processing requirements: H33-128 (BFV) for integer arithmetic on encrypted data, H33-256 for NIST Level 5 security, H33-CKKS for approximate arithmetic on encrypted floating-point data, and H33-TFHE for gate-by-gate Boolean circuits on encrypted bits. Each engine implements data protection by design at the mathematical level, not the policy level.

Article 25 also requires data protection by default. H33 implements this by making encryption the default state for all data entering the system. There is no unencrypted processing mode. There is no option to bypass FHE for performance. The default configuration is the maximum-security configuration. Organizations using H33 satisfy Article 25 automatically -- they do not need to configure, enable, or audit data protection features because encryption is the only mode of operation.

Encryption

All personal data is protected by FHE (lattice-based, quantum-resistant). Key exchange uses ML-KEM-1024 (NIST FIPS 203, NIST Level 5). Data integrity is protected by SHA3-256 with domain-separated hashing.

Post-Quantum Signatures

All attestations, audit records, and data integrity proofs are signed by three independent post-quantum signature families. An attacker must simultaneously break MLWE lattices, NTRU lattices, AND stateless hash functions to forge a single signature -- three independent mathematical hardness assumptions.

Zero-Knowledge Proofs

H33's ZK-STARK engine enables verification of data processing correctness without revealing the underlying data. This allows auditors and regulators to verify GDPR compliance without accessing the personal data being protected, creating a separation between verification authority and data access that traditional audit approaches cannot achieve.

Governance Attestation

Every security-relevant event generates a cryptographic attestation through H33-74. These attestations are deterministic, independently reproducible, and anchored to external chains (Bitcoin, Solana) for tamper-evidence. The governance attestation system provides Article 32 evidence that is stronger than any traditional log-based approach: attestations are signed, chained, and independently verifiable by any party.

GDPR Chapter V imposes restrictions on the transfer of personal data outside the European Economic Area (EEA). H33 addresses these requirements through configurable processing regions and the inherent properties of FHE-based processing.

When an organization configures H33 for EU data residency, all encryption keys are generated within EU infrastructure, all FHE computation occurs on EU-hosted instances, and no ciphertext leaves the configured region without explicit authorization. The H33-74 attestation chain records the processing region for every operation, providing cryptographic proof of data localization that can be independently verified.

H33's FHE architecture also provides a novel approach to cross-border processing: because data is encrypted under FHE before it enters the pipeline, the "personal data" in the GDPR sense (i.e., data that relates to an identifiable natural person) never crosses borders. What crosses borders is ciphertext that is computationally indistinguishable from random noise without the decryption key. This creates a strong technical argument that FHE-processed data transfers may fall outside the scope of Chapter V restrictions, though organizations should consult their own legal counsel on this interpretation.

For organizations requiring the highest level of data residency assurance, H33 offers dedicated processing instances with customer-managed encryption keys, ensuring that H33 itself cannot access personal data even in theory. This configuration supports the most stringent interpretations of GDPR data localization requirements.

This same data-segregation approach extends to other regimes built on the same transfer logic: see The Future of Cross-Border Compliance for how it generalizes beyond GDPR, and EU AI Act Compliance Requires Data Segregation for what it means specifically for AI systems operating under the EU AI Act.