The vendor offered to delete it on arrival
Crash reporting is going to a third-party service. The vendor is good, the integration is an afternoon's work, and the compliance team has one line in the contract: personal data does not leave the corporate network.
The vendor has a feature for exactly this. It strips personal fields the moment a report arrives. Their documentation recommends it, their support engineer recommends it, and it is the reason this design keeps getting approved by people who have read the requirement.
- R1The rules for what counts as personal data change often, and they are owned by a compliance team that does not ship application releases. A rule change must not require rebuilding, redeploying or restarting any application.
- R2Personal data must not cross the corporate network boundary. Not encrypted, not briefly, and not on the understanding that it is removed once it arrives somewhere else. Whatever removes it has to be on this side of the boundary, and it has to be able to read the payload in order to remove anything.
- R3No application instance may hold the credential the third party accepts. It must live somewhere the applications do not carry it and cannot leak it in a heap dump.
- R4If the third party is unreachable, applications must keep running normally and must not block waiting for it. Losing a crash report is survivable; a checkout that hangs because a reporting endpoint is slow is not.
Boundaries, outermost first: CORPORATE NETWORK: Compliance rules (change weekly), Applications (report crashes), an empty slot for the removes personal fields before they travel, tier 1, an empty slot for the holds what the vendor accepts, tier 1, an empty slot for the takes the report so the app can carry on, tier 2 Outside every boundary: Crash vendor (outside, third party), NAT gateway (public subnet) Connections: Applications calls removes personal fields before they travel — raw report Compliance rules controls removes personal fields before they travel — rules, pulled holds what the vendor accepts controls removes personal fields before they travel — credential removes personal fields before they travel calls takes the report so the app can carry on — redacted takes the report so the app can carry on sends outbound traffic to NAT gateway NAT gateway sends outbound traffic to Crash vendor — outbound only