Data subject requests (export and delete) ​
CodeLotse can export or delete the personal data it stores about one person. It does this from the command line, with quavon dsar. The operator of the instance (the controller) handles the request; CodeLotse does not authenticate data subjects.
Identify the person ​
| Option | Meaning |
|---|---|
--provider github|oidc | Where the person signs in or appears (GitHub events, or an OIDC identity provider) |
--base-url <url> | GitHub host (https://github.com or the GitHub Enterprise Server URL), or the OIDC issuer |
--external-id <id> | The provider's stable user id (GitHub numeric user id, OIDC sub) |
--login <login> | The login name; export only |
--tenant <id> | Limit the request to one tenant (otherwise all tenants) |
Logins can be renamed and reused, so deletion always needs the external id. Look the GitHub user id up with https://api.github.com/users/<login> (field id) and confirm it with the person.
For GitHub, CodeLotse only considers tenants that have an installation on the given host, or in which the person's account is a member. A person with the same id on another GitHub host is not touched.
Export ​
quavon dsar export --provider github --base-url https://github.com --external-id 583231 > export.jsonThe JSON contains a report (tables: table, row count, outcome, reason) and data: the matching rows per table across tenants. Encrypted values, token hashes and audit-chain hashes are left out. --out <file> writes the file with mode 0600 and refuses to overwrite an existing file; with the Compose wrapper the command runs in a container, so redirect stdout as shown instead.
Delete ​
quavon dsar delete --provider github --base-url https://github.com --external-id 583231 --dry-run
quavon dsar delete --provider github --base-url https://github.com --external-id 583231--dry-run reports the rows that would change and changes nothing. Each tenant is processed in its own transaction, followed by one transaction for instance-wide data. Running the command again is safe: rows that were already deleted or anonymised are not matched again.
| Outcome | Data |
|---|---|
| deleted | account (users), sessions, tenant and repository memberships, people rows, comments the person wrote (mirrored copies and copies kept for dry runs), availability and calendar feeds, expertise values |
| anonymised | author links of pull requests and issues (set empty), logins in chat commands, finding suppressions, feedback events, fix runs and dry runs (starting user and pull request author), actor names in approvals, learning decisions, rules, credentials, teams, role mappings, budget acknowledgements and identity providers (replaced with erased), the person's entry in assignment selections |
| retained | audit log entries (security and accountability, Art. 17(3)(b) and (e) GDPR; pseudonymisation awaits a counsel decision), assignment exclusion lists and apply opt-ins in repository policies, the installation account name, the legal sign-off record, encrypted debug prompt logs (expire within 7 days) and raw webhook payloads (removed after 14 days) |
The person's data on the code host itself (GitHub comments, pull requests, issues) is not changed; CodeLotse mirrors it again if new events arrive. Free text written by other people that mentions the person is not searched.
Both commands write an audit entry dsar.export or dsar.delete (instance-wide and in each affected tenant) whose target is a SHA-256 hash of the request, never the person's name or id.
Every column that holds person-linked data is listed in packages/db/src/personal-data.ts; a test fails when a new column is added without an entry there.