GDPR
Article 30
Evidence to support your records of processing
What the regulation requires
Article 30 requires controllers and processors to keep records of processing activities: purposes, categories of data subjects and personal data, recipients, transfers, time limits for erasure and security measures. Your register remains yours; Siglato supplies evidence about the AI systems it monitors that you can reference from it.
How Siglato supports it
PII signals
Built-in patterns flag personal data in the prompts, outputs and tool activity your application sends. A match is a risk signal, not a legal finding, and detection is not exhaustive.
Minimisation
A per-system policy decides whether raw content is kept, redacted before storage where supported, or omitted after evaluation.
Retention and deletion
A retention period and its recorded basis for each system, with controlled deletion and legal hold.
Security measures
Encryption of defined sensitive fields with your keys, role-based access, MFA for privileged accounts and audit records of access.
What the evidence looks like
Note
Each entry traces to its source event. Completeness is limited to what Siglato received.
The records shown are illustrations. Siglato is in early access; documentation is delivered with the evaluation bundle. Request access.