DPIA summary

Data Protection Impact Assessment.

Plain-English summary of the platform-level DPIA. Designed for procurement teams, governors and DPOs reviewing whether Founder OS is safe to deploy in their environment. For the full 16-section master DPIA, see askkira.com/policies.

What Founder OS is

Founder OS is a single-user operations cockpit that coordinates AI agents working on behalf of the founder. Each agent is specialised (relationship management, outreach drafting, research, networking, marketing, partnerships, etc.) and writes its state to disk locally.

Why a DPIA is required

Founder OS processes personal data: founder profile, contact records pulled in by agents, draft email content, pipeline records, audit logs. Anthropic API is used for LLM-backed drafting. Brave Search is used for web discovery. UK GDPR requires a DPIA for new processing that involves personal data at non-trivial scale.

Lawful basis

Founder data: legitimate interest of operating the founder's own business.
Contact data: legitimate interest in B2B outreach, balanced against recipient rights via the do-not-contact list and clear opt-out mechanism.
Audit log: legal obligation under UK GDPR Article 32 (security of processing).

Risk assessment summary

Risk	Severity	Mitigation
Unauthorised access to founder data	High	Single-user password gate, HMAC-signed sessions, 5-fail IP lockout, full audit log
API key leakage	High	Keys removed from disk; loaded only via environment variables; `.env` gitignored
Mid-write corruption of agent state	Medium	Atomic writes (temp-fsync-rename) on every save
Cross-site request forgery	Medium	CSRF tokens on every form POST; SameSite=Lax cookies
Unauthorised contact outreach	Medium	Drafts never auto-send; human review required; DNC list honoured by every agent
Inappropriate AI output	Low–Medium	Automated monitoring engine; advisory-only framing; human-review-before-send default
Sub-processor breach	Low	Each sub-processor bound by UK GDPR equivalent terms; minimal data sent

Residual risk rating: low to medium under current controls.

Data subjects

The founder using Founder OS (themselves)
Recipients of agent-drafted outreach (UK and international B2B contacts, adults in professional capacity)

No pupil data, no consumer data, no special-category data is processed.

Individual rights

UK GDPR rights honoured for every data subject:

Access · request a copy via dpo@askkira.com
Rectification · correct inaccurate data
Erasure · delete data; agents respect do-not-contact registry
Restriction · pause processing in a defined scenario
Portability · export agent state as JSON
Objection · object to processing
Complaint · lodge with the ICO at ico.org.uk

International transfers

Primary hosting is AWS London (eu-west-2). Foundation model API calls (Anthropic, Brave Search) may route data through US endpoints under Standard Contractual Clauses or equivalent UK transfer mechanisms.

Sub-processors

AWS · Anthropic · Brave Search · Google Workspace (founder's own account) · Cloudflare. See Privacy Policy for region and purpose of each.

Review cycle

Reviewed annually or on material change. Next review autumn 2026.