ScrutoraYour privacy policy is a promise. Your code is the proof.
Scrutora reads the repository and draws the map: every personal-data field, every hop it makes, and every place it comes to rest.
Someone asks you to delete their data. Can you?
Not whether your policy says you will. Whether code exists that would. Scrutora looks for the delete and export path behind every field you hold, and tells you which ones have none.
No code was found that deletes or exports 7 of these fields. If someone asked you to remove their data, you could not show that these would be included.
Most of your schema is travelling unprotected.
Every classified field, followed from the code that touches it to the log, store or third party it reaches. No questionnaire, no workshop. This is read out of the repository.
Four passes over one graph, not four point tools.
Compliance is the proof, not the pitch.
Nobody buys a scanner to feel compliant. They buy it because something is wrong and they need it named, explained and fixed. Every finding opens into why it matters, the exact path the data took, and the change to make, with the clause attached at the end, where the auditor will look for it.
Personal data in logs exceeds the stated purpose of processing and breaches security-safeguard requirements.
Mask or redact the address before logging. Replace line 50 with maskEmail(user.email).
Point it at a repository.
A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.