Privacy boundariesfor identity anddelegated authority.

Privacy choices govern what is collected, disclosed, accessed and kept as reviewable evidence across the identity and authority lifecycle. Zoiko iD is designed to disclose only the minimum claims a decision needs, to restrict access by policy, and to keep provenance for each record. These are design principles; their implementation status is shown with each statement, and formal legal terms live in the Privacy Notice.

Talk to an identity expert Explore technical architecture

Five design principles, each with its status

These describe intended behavior. Each card states whether the principle is intended, designed, or independently reviewed. Selective disclosure and privacy-preserving techniques are not claimed as implemented.

Minimum necessary claims

Only what a defined decision requires is presented.

Designed

Limited disclosure

Records are shown to authorized roles, not broadly.

Designed

Policy-based access

Access is decided by policy, not by the presence of data.

Designed

Provenance

Each record names its source and originating service.

Intended

Governed currentness

Each statement shows when it was last reviewed.

Intended

From actor to permitted view, one step at a time

The flow shows how a request is limited at each stage. It is a conceptual model, not real user data, and it does not assert automatic processing or real-time revocation.

Actor

The person, organization, service, machine or agent making the request.

Step 1

Verified claims

Only the claims the decision needs are presented.

Step 2

Mandate

Any organizational affiliation or delegation, recorded explicitly.

Step 3

Decision

Purpose- and resource- scoped policy evaluation.

Step 4

Permitted view

Evidence shown to the authorized reviewer only.

Step 5

Denial

The request stops at the decision and the reason is recorded.

Expiry

A mandate that has ended no longer supports the decision.

Revocation

A withdrawn mandate may need re-evaluation; timing is not claimed here.

Different actors, different privacy considerations

Machine and agent identities can be linked to a responsible human or organization. Being an agent does not remove or grant any data-subject right.

Actor class	Identity context	Intended authority	Minimization concern	Evidence scope
Person	Verified individual	Own permissions, within grants	Personal attributes limited to need	Actions the person took
Organization	Explicit affiliation record	Represented actions, under mandate	Organizational, not personal, detail	Mandate lifecycle
Service account	Workload identity with a sponsor	Narrow, named role	Avoid carrying person data	Service actions and sponsor
Machine	Device or process identity	Bounded duty, bounded time	Device data limited to function	Operational events
AI agent	Principal linked to a sponsor	Only under explicit mandate	Unrelated personal data not exposed	Sponsor and mandate context

Five concepts that are often confused

Each concept answers a different question. None of them can stand in for another. Legal basis examples require approval from Legal before publication.

Opt-in preference

A person's stated choice about optional features.

Legal basis

The statutory reason a processing activity is lawful. Set by Legal.

Business mandate

An organization's explicit grant of authority to an actor.

Policy evaluation

The decision made against current policy and context.

Controls, with their evidence status

Policy-based access review

Reviewer permissions follow policy and role.

Designed

Redaction

Restricted fields are hidden from unauthorized viewers.

Intended

Audit logging

Access to evidence is logged for accountability.

Intended

Exception handling

Exceptions are escalated to the named owner.

Owner sign-off pending

Incident escalation

Security incidents follow the Security route.

Unavailable here

Accountability

Named owners review each privacy claim.

Independently reviewed where stated

Collect less, decide in scope, record proportionately

Retention and erasure follow reviewed records, not assumptions made on this screen. No period, deletion schedule or backup commitment is stated here.

Collect

Only approved attributes are collected.

Evaluate

Decisions stay within scope.

Record

Evidence is proportional to the decision.

Revoke

Access may be withdrawn when context changes.

Dispose

Erasure follows the approved retention record.

Retention

Retention periods appear here only when a reviewed Privacy record is present. Until then, this section hands off to the Privacy Notice.

Evidence by audience and access level

Confidential material is never downloaded directly. Each item lists who may request it and the approval it needs.

Public disclosures

Factual pages reviewed for currentness.

Audience: any visitor

Security evidence

Approved security material, by request.

Audience: security reviewers

Agreements

Commercial and legal terms, through Legal.

Audience: counsel and procurement

Architecture references

Technical documentation for architects.

Audience: solution architects

Who supplies, approves and records data

Your identity provider, your applications and Zoiko iD each keep their own responsibilities. Controller and processor roles are to be confirmed per processing activity. Nothing here infers a subprocessor or a data location.

Identity provider

Supplies authenticated attributes under your agreement.

Your organization

Customer application

Requests decisions and enforces them in its own runtime.

Your organization

Zoiko iD policy and evidence

Evaluates policy and produces the decision record.

Proposed platform

Developer APIs

Documented interfaces to the integrations above.

Engineering

Role	Owner	Approval	Audit destination
Data supplier	Identity provider or application	Per your agreement	Source system
Controller / processor status	To be confirmed	Legal	Privacy Notice, once approved
Approver of policy	Your administrators	Per your governance	Decision record
Audit destination	Owning service	Security	Evidence & Audit

Formal rights go to their owners

Rights requests are handled by Legal operations through their own intake, not through a sales form. Routes below appear only when registered; none has a timeline stated here.

Read the Privacy Notice

Formal legal disclosures, approved by Legal.

Manage cookie settings

Only where preference tooling is implemented.

Exercise privacy rights

Routed to the governed rights channel.

Ask a privacy question

General questions, separate from rights requests.

Do not send identity documents here. Public forms never collect ID documents, credentials or payment data. Verification for rights requests is handled by Legal operations.

Architecture does not decide where data lives

Where data is stored or transferred is set by reviewed privacy records, not by this diagram. No residency, transfer mechanism or vendor list is stated on this page.