- prod-opsgdpr
The client wanted production data in preprod. I said no, then gave them something better.
A reasonable request from a reasonable client: make preprod look like prod, with real data. Why that would have been the worst security decision in the project, how I pushed back without a fight, and the anonymised seed pipeline that made preprod more useful than a copy would have been.
-
PII and data masking: how to stop leaking personal data everywhere
Personal data spreads into logs, staging, analytics, and exports, far beyond the users table. A practical guide to masking, pseudonymization, and anonymization, and knowing which one you actually did.
-
GDPR data retention and deletion: a practical guide for developers
The two GDPR duties engineers get wrong most often are keeping data too long and failing to fully delete it. A hands-on guide to retention windows, the right to erasure, and the part nobody plans for: backups.