ScrutoraWriting it was the easy part. Keeping it true is the job.
Most organisations have a Record of Processing. Far fewer have one that matches the software, because the software changed forty times since anyone opened the document.
A document that is only true on the day it is signed.
An SDK is added, a vendor is swapped, a webhook is pointed somewhere new. None of those changes prompt anyone to open the RoPA.
A field is added to a form. It is personal data from the first commit and it enters no register until the next review.
The document has an owner. The delta between it and reality has nobody, which is why it grows.
The parts the code proves are never stale.
Data categories, storage locations, recipients and special-category flags come from the scan, so they update when the code does. Lawful basis, purposes, retention and the controller details stay with you, because they are decisions and no scanner should invent them.
What changed since the last one.
Because it is generated rather than written, two records can be compared. A new recipient or a new category shows up as a difference you can review, which is the closest thing to a maintenance process that has ever worked for this document.
Generate one from a repository.
A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.