Milestone 2 · design approved

The prototype is moving. Collection remains closed.

The sponsor authorized controlled implementation of the purposes, consent records and safeguards. The simulation has no identity fields and accepts no citizen data.

0/10approved policies
2/15implemented controls
0/4enabled channels
0citizen records collected

Proposed processing register

Every use must be authorized separately.

The displayed CDP classification is deliberately conservative and provisional until formally confirmed.

data-rightsData-rights requests

CDP authorization provisionally required

Disabled
identity-verificationSeparate identity verification

CDP authorization provisionally required

Disabled
member-communicationsMember communications

CDP authorization provisionally required

Disabled
member-enrollmentMembership application

CDP authorization provisionally required

Disabled
membership-cardMembership-card issuance

CDP authorization provisionally required

Disabled
territorial-analyticsAggregate territorial analytics

CDP authorization provisionally required

Disabled

Opening barriers

Two protections are in place. The remaining controls require evidence.

Activation requires named owners, legal review, MFA, territorial permissions, encryption, auditing, rights operations and tested recovery.

AUDIT-01Read, change and export audit loggingTo implement
AUTHZ-01Role- and territory-scoped accessTo implement
BACKUP-01Encrypted backup and tested recoveryTo implement
CRYPTO-01Encryption and key managementTo implement
GOV-01Named and authorized accountable ownersTo implement
IAM-01Approved public authenticationTo implement
IAM-02Mandatory MFA for privileged accountsTo implement
IR-01Incident and breach responseTo implement
LEGAL-01Legal review and CDP formalitiesTo implement
RET-01Approved retention and verifiable deletionTo implement
RIGHTS-01One-month data-rights procedureTo implement
SAFE-01Enrollment kill switchImplemented
SAFE-02No individual political scoringImplemented
SDLC-01Independent security review and testingTo implement
VENDOR-01Vendor contracts, residency and transfersTo implement

Approval required

Three leadership decisions block opening.

  1. 01

    Name the legal representative, product owner, data-protection owner and security owner.

  2. 02

    Approve hosting, data residency, access from abroad and the authentication provider.

  3. 03

    Obtain Senegalese counsel and CDP approval for fields, notices, retention, rights and the national-ID exclusion.

Controlled implementation

A testable journey with zero personal data.

The simulation stores only a fictional scenario and demo channel choices in MySQL.

Test the prototype