Data Privacy (GDPR)

GDPR for agent fleets reduces to two hard problems: prove that processing happened the way you say it did, and delete what you are obliged to delete without breaking everything else. CueCrux treats both as engineering.

Proof comes from the receipt spine. Every state mutation an agent performs is signed and hash-chained, and every connection binds to a passport, so there are no anonymous writes. Any receipt resolves to who acted, at what trust tier, under which grants. That is what an accountability obligation looks like when it is enforced by machinery rather than asserted in a records-of-processing document.

Erasure is scoped forget with a dry-run: preview exactly which facts, sessions, and artefacts a deletion will touch before executing it, then execute, and the erasure itself mints a receipt. This is GDPR Article 17 implemented as a tool call, not a quarterly clean-up project.

Scope discipline comes from RCX: each agent request runs under a short-lived capability token scoped to tools, tenant, and tier, self-issued locally and offline-verifiable. And because the Crux Daemon runs on your own hardware, data residency is the default posture rather than a contractual promise.