How Does illuminis Handle Data Privacy and GDPR Compliance?

Learn how the illuminis Developer Platform handles data privacy, GDPR compliance, data processing agreements,and user data protection for hosted applications.

Data Privacy and GDPR Compliance on illuminis

The illuminis Developer Platform is built with data privacy as a core design principle. The platform provides infrastructure-level privacy controls and compliance tooling that help developers meet regulatory requirements including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA),and other global privacy frameworks. This shared responsibility approach means the platform handles infrastructure compliance while developers maintain responsibility for application-level data handling decisions.

Platform-Level Privacy Controls

illuminis implements privacy controls at the infrastructure layer that automatically apply to all hosted applications:

Data residency options: Choose deployment regions to comply with data localization requirements. Available regions include US East, US West, EU West (Ireland),and EU Central (Frankfurt)
Encryption everywhere: All data is encrypted in transit with TLS 1.3 and at rest with AES-256, meeting encryption requirements under GDPR Article 32
Access logging: All access to customer data is logged and auditable, supporting transparency and accountability requirements
Automated data backup: Regular encrypted backups with configurable retention periods to balance data protection with storage minimization
Network isolation: Application data is isolated at the network level, preventing unauthorized cross-application data access

GDPR Compliance Support

The platform provides tools and infrastructure to help developers comply with key GDPR requirements:

Data Processing Agreement: illuminis provides a standard DPA that covers the platform's role as a data processor for applications hosted on the platform
Right to access: Built-in APIs for exporting user data in machine-readable formats to support Subject Access Requests
Right to erasure: Platform tooling for identifying and deleting user data across databases and backups to support deletion requests
Consent management: SDK components for implementing cookie consent banners and data processing consent flows
Data breach notification: Incident detection and notification infrastructure that supports the 72-hour GDPR breach notification requirement

Developer Responsibilities

While the platform provides infrastructure-level compliance, developers remain responsible for how their applications collect, process,and use customer data. Developer responsibilities include implementing appropriate consent mechanisms for data collection, maintaining an accurate privacy policy for their application, processing data only for stated and lawful purposes, responding to data subject requests forwarded through the platform,and conducting data protection impact assessments for high-risk processing activities.

CCPA and Other Frameworks

The platform privacy controls also support compliance with the California Consumer Privacy Act, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA),and the Australian Privacy Act. The data export, deletion,and consent tools are designed to be framework-agnostic, providing foundational capabilities that apply across multiple regulatory environments.

Third-Party Subprocessors

illuminis maintains a transparent subprocessor list that includes AWS for infrastructure hosting, Stripe for payment processing,and any additional service providers involved in data processing. This list is available to developers and their customers to support supply chain transparency requirements under GDPR and similar regulations.