Data Processing Guide

Last updated: 2026-05-31. Version: 1.0.

For the visual architecture diagram see Architecture & Data Flow.

---

1. Data Categories Processed

---

2. Data Flows

2.1 Render / Seal Flow

flowchart TD
    A1(["👤 User - SharePoint SPFx command"])
    A2(["🖥️ Source System - direct API call"])
    A1 -->|"SPFx command"| B
    A2 -->|"POST /api/render (Function Key · HTTPS)"| B
    B["The Dispatcher<br/>func-dispatcher<br/>(your Azure subscription)"]
    B --> C["Read template + payload<br/>SharePoint via Graph API · MSI"]
  B --> D1["Validate entitlement<br/>Tier 1 - In-memory cache"]
  D1 --> D2["Tier 2 - SharePoint license.json"]
  D2 --> D3["Tier 3 - Licensing API (fallback)"]
  D3 --> D4["Tier 4 - Grace mode (API unavailable only)"]
    B --> E["Enqueue render message<br/>Azure Service Bus queues · MSI"]
    E --> F["The REFRACT Engine<br/>func-processor<br/>(your Azure subscription)"]
    F --> G["Read template<br/>SharePoint via Graph API · MSI"]
    F --> H["Render PDF<br/>in-memory - Ephemeral Processing Unit"]
    H --> I["Upload PDF<br/>SharePoint output library<br/>Graph API · MSI"]
    H --> J["Write audit event<br/>Azure Blob Storage JSONL · MSI"]
    F --> K["Update Activity list<br/>SharePoint · MSI"]

The Dispatcher validates entitlement through local tiers first. It falls back to the REFRACT PDF Licensing API only when the cache and SharePoint entitlement file are missing or expired.

Document content flows only within your Microsoft 365 tenant and your Azure subscription.

2.2 License Validation (Tier 3 Fallback)

sequenceDiagram
    participant D as The Dispatcher<br/>func-dispatcher<br/>(your Azure subscription)
  participant T1 as Tier 1<br/>In-memory cache
  participant T2 as Tier 2<br/>SharePoint license.json
  participant L as Tier 3<br/>REFRACT PDF Licensing API<br/>(fallback)
  participant T4 as Tier 4<br/>Grace mode

  D->>T1: Validate entitlement
  T1-->>D: Cache hit or miss
  D->>T2: Check signed license.json
  T2-->>D: Valid, expired, or missing
  D->>L: Fallback only if T1 and T2 miss
  Note over D,L: Body: { licenseKey: string, tenantId: string }
  Note over D,L: ❌ No document content<br/>❌ No user PII<br/>❌ No file data<br/>The Microsoft 365 tenant ID identifies an organization and is not intended to identify a natural person.
  L-->>D: { features: { ... } }
  D->>T4: Use grace mode only if API is temporarily unavailable
  Note over L: REFRACT PDF does not retain document content, user PII,<br/>or tenant business data from licensing requests.<br/>Operational logs are limited to service health,<br/>security monitoring, and abuse prevention.

No document data, no user PII, and no file content is sent to the REFRACT PDF Licensing API. The Microsoft 365 tenant ID identifies an organization and is not intended to identify a natural person. REFRACT PDF does not retain document content, user PII, or tenant business data from licensing requests. Operational logs are limited to service health, security monitoring, and abuse prevention.

2.3 eSign Portal Flow (External Redirect)

sequenceDiagram
    actor Approver as 👤 Approver (browser)
    participant Portal as REFRACT PDF eSign Portal<br/>(REFRACT PDF-operated · stateless)
    participant Dispatcher as The Dispatcher<br/>func-dispatcher<br/>(your Azure subscription)

    Approver->>Portal: Click eSign link in email (HMAC-token in URL)
    Portal->>Dispatcher: GET /api/esign/verify?token=...
    Note over Portal,Dispatcher: Token only - ❌ no document bytes<br/>❌ no approver identity transmitted
    Dispatcher-->>Portal: Token valid · approver context
    Portal-->>Approver: Redirect to Dispatcher signing page
    Approver->>Dispatcher: Load signing page (your Azure Function)
    Note over Approver,Dispatcher: Signing page served from YOUR Azure subscription<br/>not from REFRACT PDF infrastructure
    Approver->>Dispatcher: Submit signature
    Dispatcher->>Dispatcher: Record approval · enqueue seal message

The eSign Portal is a stateless relay. It stores no document data and no approver PII. The signing page is served from your Azure Function, not from REFRACT PDF infrastructure.

2.4 Licensing Data Processing (Tiered Entitlement Cache)

REFRACT PDF uses a 4-tier license validation cascade to reduce runtime dependency on external licensing services.

Validation Tier Sequence

Nightly Sync Flow

The Dispatcher runs a scheduled nightly sync at 2:00 AM UTC:

1. Calls the Licensing API with licenseKey and tenantId (no document content).
2. Receives a JWS ES256-signed entitlement payload containing feature flags, plan, expiry date, and tenant ID binding.
3. Verifies the tenantId in the signed payload matches the deployment tenant before writing.
4. Writes the refreshed entitlement to a license.json file in your SharePoint document library (customer-controlled).
5. Pushes usage metrics to the Licensing API:
   • Monthly aggregates (not per-document granularity)
   • Metrics: esign (eSign session count), delivery (delivery job count), delivery_email (email delivery variant), delivery_sms (SMS delivery variant)
   • Data transmitted: integer counters only; no document content, no end-user identity information
   • Keyed by: licenseKey (which is bound to your tenant during activation)
6. If the license is revoked or expired, the sync deletes license.json from SharePoint so the next runtime check reaches Tier 3 (API) and returns the correct denied result.

Usage Metrics Storage

Usage metrics are stored as monthly aggregate counters keyed by licenseKey. Metrics do not contain document content, user identities, file names, document metadata, or workflow payloads.

• Aggregated: Rolling monthly totals (reset on month boundaries), not per-document or per-user.
• Tenant-identifiable: Keyed by licenseKey, which is cryptographically bound to your tenantId during license activation.
• Restricted to REFRACT PDF: Usage metrics do not leave your subscription for any purpose other than licensing enforcement. They are not included in telemetry or shared with third parties.

Entitlement File Storage

The license.json entitlement file is stored in your SharePoint document library. It is cryptographically signed using JWS ES256 (ECDSA P-256): REFRACT PDF holds the private signing key; your Dispatcher Function holds only the public verification key. Any modification to the file causes signature validation to fail and the file is silently discarded, falling through to Tier 3.

Runtime Behavior

The Licensing API is not called on every request. The Dispatcher evaluates the tier cascade in order:

• If the in-memory cache (Tier 1) is valid (< 24 h old), the API is not called.
• If the SharePoint license.json (Tier 2) is present and its JWS signature is valid, the API is not called (non-trial plans).
• If both Tiers 1 and 2 miss or are expired, the Dispatcher calls the Licensing API directly (Tier 3).
• If the API is unreachable and a valid response was received within the last 48 hours, the system continues on the last cached entitlement (Tier 4 grace).

Grace Period

The 48-hour grace period applies only when the Licensing API is temporarily unreachable (network outage, planned maintenance). It does not apply to licenses that are revoked or expired - those return a denied response immediately. After the 48-hour grace window, access is denied until the API is reachable again.

No document content is transmitted during licensing operations at any tier.

---

3. Data Residency

REFRACT PDF deploys entirely into your chosen Azure region, set via the -Location parameter in deploy.ps1. All document data, audit logs, and encryption keys reside in that region.

REFRACT PDF-operated services:

---

4. Data Retention

Recommended storage lifecycle policy (set in Bicep or the Azure portal):

---

5. GDPR Posture

Roles

Lawful Basis

REFRACT PDF processes document payloads on the instructions of the Data Controller (your organisation). The lawful basis for processing is the performance of a contract (document generation and approval workflow services).

Personal Data in REFRACT PDF

• Approver email addresses are the primary PII processed by REFRACT PDF workflow functions. They are AES-256-GCM encrypted before storage in Azure Table Storage. The encryption key is in your Azure Key Vault.
• Document payload fields may contain personal data depending on your template design. REFRACT PDF treats all payload fields as potentially personal data and applies the same encryption and access controls.
• Portal session IP address is optionally logged in App Insights telemetry for security purposes.

Data Subject Rights

Because all data is stored in your Azure subscription and SharePoint tenant:

• Right of Access - query your Azure Blob Storage and SharePoint via your admin tooling.
• Right to Erasure - delete blobs from Azure Blob Storage; delete list items from SharePoint. Sealed .raudit archives in WORM-locked containers cannot be deleted before retention expiry (by design - required for audit integrity).
• Data Portability - .raudit archives are standard ZIP containers; PDF outputs are standard PDF files.

Cross-Border Transfers

The only cross-border transfer to REFRACT PDF-operated services transmits license key and tenant ID (non-personal data under GDPR Art. 4(1)) and HMAC tokens (pseudonymous, no identity information). A Data Processing Agreement (DPA) with REFRACT PDF is available on request at contact@refractlogic.com.

---

6. Breach Notification

In the event of a suspected breach within REFRACT PDF-operated infrastructure (Licensing API or eSign Portal), REFRACT PDF will notify affected customers within 72 hours of becoming aware of the incident. See Incident Response for the full procedure.

Because your document data is stored in your own Azure subscription, a breach of REFRACT PDF-operated infrastructure does not expose your document content. A breach of your Azure subscription is governed by your incident response procedures and Microsoft's contractual obligations under your MCA.

---