Qryptiona — Automated Privacy Rights & Data Mapping Engine

A Privacy Engineering portfolio project demonstrating automated DSAR processing, PII discovery, and dynamic Data Mapping for GDPR/CCPA compliance — built for an AdTech context.

---

The Problem

Privacy teams at AdTech companies manually process "Right to Access" and "Right to be Forgotten" requests across fragmented databases — a process that takes days per request. Tracking where sensitive PII lives (Data Mapping / RoPA) is equally error-prone when done manually.

The Solution

Qryptiona automates the entire DSAR lifecycle:

1. Automated DSAR Fulfillment — One API call aggregates or erases a user's data across all tables
2. Intelligent PII Discovery — Dual-layer scanning using regex + Microsoft Presidio NLP
3. Dynamic Data Map Generation — Living, queryable map of PII locations with risk classification
4. Full Audit Trail — Every action logged for GDPR Art. 30 compliance

---

Architecture

┌─────────────────────────────────────────┐
│          React TypeScript Frontend       │
│  ┌──────┬──────────┬─────────────────┐  │
│  │ DSAR │ Data Map │   Audit Trail   │  │
│  └──┬───┴────┬─────┴────────┬────────┘  │
└─────┼────────┼──────────────┼───────────┘
      │ HTTP   │              │
┌─────┼────────┼──────────────┼───────────┐
│     ▼        ▼              ▼           │
│  FastAPI Backend (Python)               │
│  ┌──────────────────────────────────┐   │
│  │  DSAR Service  │  PII Scanner    │   │
│  │  Audit Service │  (Presidio NLP) │   │
│  └────────┬───────┴────────┬────────┘   │
│           │                │            │
│  ┌────────▼────────────────▼────────┐   │
│  │        SQLite Database           │   │
│  │  users │ tracking │ ads │ audit  │   │
│  └──────────────────────────────────┘   │
└─────────────────────────────────────────┘

---

Quick Start

Prerequisites

• Python 3.10+
• Node.js 18+

1. Backend Setup

cd backend
python -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate
pip install -r requirements.txt

# Optional: Install Presidio for NLP-powered PII detection
pip install presidio-analyzer
python -m spacy download en_core_web_lg

# Start the API server
uvicorn main:app --reload --port 8000

The API auto-initializes the database and seeds it with mock data on first start.

2. Frontend Setup

cd frontend
npm install
npm run dev

3. Open the Dashboard

• Frontend: http://localhost:5173
• API Docs: http://localhost:8000/docs

---

API Endpoints

DSAR — Data Subject Access Requests

Method	Endpoint	Description	GDPR Article
GET	/api/dsar/{email}	Right to Access — retrieve all user data	Art. 15
DELETE	/api/dsar/{email}	Right to Erasure — delete all user data	Art. 17
GET	/api/dsar/users	List all data subjects	—
GET	/api/dsar/audit	Full audit trail	Art. 30
GET	/api/dsar/audit/{email}	Audit trail for specific email	Art. 30

Data Map — PII Discovery & Classification

Method	Endpoint	Description
GET	/api/data-map	Schema-level PII scan (fast, regex)
GET	/api/data-map/deep-scan	Content-level deep scan (Presidio NLP)

System

Method	Endpoint	Description
GET	/api/dashboard/stats	Aggregate dashboard statistics
GET	/api/health	Health check

---

Testing

cd backend
source venv/bin/activate
pytest tests/ -v

24 tests covering DSAR access, erasure, audit logging, PII scanning, and risk classification.

---

GDPR/CCPA Compliance Mapping

Feature	GDPR Article	CCPA Section
Right to Access	Art. 15	§1798.110
Right to Erasure	Art. 17	§1798.105
Data Portability	Art. 20	§1798.100
Audit Trail	Art. 30 (RoPA)	—
Consent Tracking	Art. 7	§1798.120
PII Data Mapping	Art. 30	§1798.100

---

Tech Stack

Layer	Technology	Purpose
Backend	Python / FastAPI	REST API, business logic
Frontend	React / TypeScript	Dashboard UI
Database	SQLite	Portable data store
PII Detection	Microsoft Presidio + Regex	NLP-powered PII scanning
Testing	Pytest	Automated test suite

---

Project Structure

Qryptiona/
├── backend/
│   ├── main.py                  # FastAPI entry point
│   ├── requirements.txt
│   ├── database/
│   │   ├── connection.py        # SQLite connection manager
│   │   └── seed.py              # Mock data seeder
│   ├── models/
│   │   └── schemas.py           # Pydantic schemas
│   ├── routers/
│   │   ├── dsar.py              # DSAR endpoints
│   │   ├── data_map.py          # PII mapping endpoints
│   │   └── dashboard.py         # Dashboard stats
│   ├── services/
│   │   ├── dsar_service.py      # DSAR business logic
│   │   ├── pii_scanner.py       # Dual-layer PII detection
│   │   └── audit_service.py     # Audit logging
│   └── tests/
│       ├── test_dsar.py
│       └── test_data_map.py
├── frontend/
│   ├── src/
│   │   ├── App.tsx              # Main layout
│   │   ├── api/client.ts        # Typed API client
│   │   ├── components/          # React components
│   │   └── types/index.ts       # TypeScript interfaces
│   └── index.html
└── README.md