The channel is also a compliance event.
Article 30 processing records, Article 33 breach notifications, Article 35 DPIA supporting evidence: audit logs often contain the personal data they were created to document. When a Data Protection Authority opens an investigation, or when an external auditor requests evidence, those logs have to travel. Email is the default. Email is also a second data controller, a stored copy outside your retention schedule, and a new Article 32 risk surface.
It gets harder when you need to show the investigator that the evidence they received is the evidence you sent, and that nobody changed it on the way. Standard email gives no such assurance. A breach of the channel would be both an evidence problem and a second notifiable incident.
Delivered once, then wiped.
Your browser encrypts the audit package with AES-256-GCM before it leaves. The key sits in the link, after the # sign, and never reaches our server. Once the investigator or auditor downloads the package, the relay wipes its copy from memory. Anyone who opens the link after that sees that the file has already been collected and wiped.
This route does not produce a signed receipt. Paramant only makes one when a file is collected through the API. AES-256-GCM does show whether anything was changed: a modified package will not decrypt.
On this route, which is a ParaSend web app transfer, the relay holds only ciphertext and cannot read what it carries. EU/DE hosting means no US CLOUD Act production orders apply. The transmission does not create a second data controller for the audit evidence.
From export to evidence.
Which GDPR requirements this helps with.
| Requirement | Paramant control |
|---|---|
| GDPR Art. 32: appropriate technical measures | AES-256-GCM in your browser, with the key only in the link; relay cannot decrypt; EU/DE hosting |
| GDPR Art. 5(1)(e): storage limitation | Burn-on-read: a web app transfer is held only until the first download, then wiped; an API link is wiped after its last read |
| Evidence integrity | AES-256-GCM is authenticated encryption: a modified package will not decrypt. This route does not produce a signed receipt. |
| GDPR Art. 28: processor agreement | Standard DPA at /dpa, signable electronically and applies to all plans. The relay does process personal data (account email, IP for rate limiting and abuse-prevention); what it never holds is document plaintext or keys. |