Designing a Privacy-First Architecture for Sensitive Data: Zero-IP Logging, Postgres RLS, and AI Safety
When building software that handles sensitive human data (like workplace feedback, satisfaction surveys, and compliance reports), security and privacy cannot be treated as optional features or mere legal disclaimers. They must be embedded into the core system design. At Sigilo Profissional ( sigiloprofissional.com.br ), a B2B SaaS platform focused on Workplace Climate Surveys, eNPS, and…
When constructing a software system to manage sensitive human data, security and privacy cannot be considered secondary aspects or mere legal obligations. These elements must be fundamentally integrated into the system's architecture. Sigilo Profissional, a B2B SaaS platform specializing in workplace climate surveys, employee net promoter scores (eNPS), and whistleblowing channels, has adopted ISO 37002 compliance and GDPR/LGPD guidelines.
Privacy serves as a prerequisite for creating a psychologically safe environment for employees. If they lack confidence in the platform's anonymity, their participation ceases entirely.
The security architecture and privacy controls utilized in Sigilo Profissional's Python (FastAPI) and PostgreSQL infrastructure are as follows:
1. Multi-Tenancy Security Measures:
- Application Layer: Each query filters by firm_id within SQLAlchemy.
- Database Engine Layer: PostgreSQL Row Level Security (RLS) is enabled on all tenant tables. Application middleware assigns SET LOCAL app.firm_id for each database session. To ensure comprehensive isolation, both layers must be activated concurrently.
2. Anonymized Data Handling Protocols:
- Zero-IP Logging Protocol: NGINX and edge proxies eliminate the X-Forwarded-For and client IP headers, preventing IP addresses from being stored in logs, application memory, or databases.
- Cryptographic Protocol Tokens: Anonymous reports are identifiable through random protocol tokens (e.g., SGL-2026-7X3K). Reporters can check the progress of their reports using their protocol token, without needing to create an account or accept session cookies.
3. PII Protection for Responsible AI Applications:
- Large Language Models (LLMs) are utilized to help employees construct clear reports and summarize qualitative eNPS sentiment for management. To avoid PII from reaching external AI models, a LiteLLM proxy layer filters out names, emails, phone numbers, and location metadata before sending prompts to the AI. AI outputs are solely employed for guidance and categorization and are never used to make autonomous decisions.
4. Audit Trails and Regulatory Compliance:
- Immutable audit logs are maintained for administrative activities, such as status changes and report triage. Cryptographic hashing ensures the transparency of these actions without exposing whistleblower anonymity.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
