Data Processing Guide

Last updated: 2026-05-31. Version: 1.0.

For the visual architecture diagram see Architecture & Data Flow.

---

1. Data Categories Processed

---

2. Data Flows

2.1 Render / Seal Flow

flowchart TD
    A1(["👤 User - SharePoint SPFx command"])
    A2(["🖥️ Source System - direct API call"])
    A1 -->|"SPFx command"| B
    A2 -->|"POST /api/render (Entra ID Bearer JWT · HTTPS)"| B
    B["The Dispatcher<br/>func-dispatcher<br/>(your Azure subscription)"]
    B --> C["Read template + payload<br/>SharePoint via Graph API · MSI"]
  B --> D1["Validate entitlement<br/>Tier 1 - In-memory cache"]
  D1 --> D2["Tier 2 - SharePoint license.json"]
  D2 --> D3["Tier 3 - Licensing API (fallback)"]
  D3 --> D4["Tier 4 - Grace mode (API unavailable only)"]
    B --> E["Enqueue render message<br/>Azure Service Bus queues · MSI"]
    E --> F["The REFRACT Engine<br/>func-processor<br/>(your Azure subscription)"]
    F --> G["Read template<br/>SharePoint via Graph API · MSI"]
    F --> H["Render PDF<br/>in-memory - Ephemeral Processing Unit"]
    H --> I["Upload PDF<br/>SharePoint output library<br/>Graph API · MSI"]
    H --> J["Write audit event<br/>Azure Blob Storage JSONL · MSI"]
    F --> K["Update Activity list<br/>SharePoint · MSI"]

The Dispatcher validates entitlement through local tiers first. It falls back to the REFRACT PDF Licensing API only when the cache and SharePoint entitlement file are missing or expired.

Document content flows only within your Microsoft 365 tenant and your Azure subscription.

2.2 License Validation (Tier 3 Fallback)

sequenceDiagram
    participant D as The Dispatcher<br/>func-dispatcher<br/>(your Azure subscription)
  participant T1 as Tier 1<br/>In-memory cache
  participant T2 as Tier 2<br/>SharePoint license.json
  participant L as Tier 3<br/>REFRACT PDF Licensing API<br/>(fallback)
  participant T4 as Tier 4<br/>Grace mode

  D->>T1: Validate entitlement
  T1-->>D: Cache hit or miss
  D->>T2: Check signed license.json
  T2-->>D: Valid, expired, or missing
  D->>L: Fallback only if T1 and T2 miss
  Note over D,L: Body: { tenantId: string, licenseKey: string, signature: string, dispatcherUrl?: string }
  Note over D,L: ❌ No document content<br/>❌ No user PII<br/>❌ No file data<br/>The Microsoft 365 tenant ID identifies an organization and is not intended to identify a natural person.
  L-->>D: { features: { ... } }
  D->>T4: Use grace mode only if API is temporarily unavailable
  Note over L: REFRACT PDF does not retain document content, user PII,<br/>or tenant business data from licensing requests.<br/>Operational logs are limited to service health,<br/>security monitoring, and abuse prevention.

No document data, no user PII, and no file content is sent to the REFRACT PDF Licensing API. The Microsoft 365 tenant ID identifies an organization and is not intended to identify a natural person. REFRACT PDF does not retain document content, user PII, or tenant business data from licensing requests. Operational logs are limited to service health, security monitoring, and abuse prevention.

2.3 eSign Portal Flow

sequenceDiagram
    actor Signer as 👤 Signer (browser)
    participant Portal as eSign Portal<br/>(REFRACT-operated)
    participant Dispatcher as The Dispatcher<br/>func-dispatcher<br/>(your Azure subscription)

    Signer->>Portal: Open signing link (session/group IDs in URL)
    Portal->>Portal: Look up session, challenge OTP
    Portal-->>Signer: Serve the signing UI
    Signer->>Portal: Draw signature, complete fields, submit
    Portal->>Dispatcher: POST /api/esign/callback (HMAC-signed, includes signature + field values)
    Dispatcher->>Dispatcher: Verify HMAC, store values, enqueue seal message

The eSign Portal keeps encrypted signer contact details, OTP hashes, and session state in its own database - it is not stateless. Signature and field values transit the portal in memory during the signed callback but are not written to the portal's own storage; the document the signer views, the signed copy, and the certificate are all served from your own Dispatcher, redirected to by the portal rather than relayed through it.

REFRACT Delivery and REFRACT Workflow downloads follow the same redirect pattern as eSign above: the portal resolves a per-download credential and redirects the browser to your own deployment, which serves the document directly. For REFRACT Workflow that deployment is always your Dispatcher; for REFRACT Delivery it is your Dispatcher, or, when the document is SharePoint-stored, your SharePoint site directly. The portal is never in the byte path for a download, across any of the three products. The one exception is a REFRACT Workflow attachment upload: the file passes through the portal's own process in memory on its way to your Dispatcher, and is never written to REFRACT storage.

2.4 Licensing Data Processing (Tiered Entitlement Cache)

REFRACT PDF uses a 4-tier license validation cascade to reduce runtime dependency on external licensing services.

Validation Tier Sequence

Nightly Sync Flow

The Dispatcher runs a scheduled nightly sync at 2:00 AM UTC:

1. Calls the Licensing API with tenantId, licenseKey, an identity token, and your deployment address (no document content).
2. Receives a JWS ES256-signed entitlement payload containing feature flags, plan, expiry date, and tenant ID binding.
3. Verifies the tenantId in the signed payload matches the deployment tenant before writing.
4. Writes the refreshed entitlement to a license.json file in your SharePoint document library (customer-controlled).
5. Pushes usage metrics to the Licensing API:
   • Monthly aggregates (not per-document granularity)
   • Metrics: esign (eSign session count), delivery (delivery job count), delivery_email (email delivery variant), delivery_sms (SMS delivery variant)
   • Data transmitted: integer counters only; no document content, no end-user identity information
   • Keyed by: licenseKey (which is bound to your tenant during activation)
6. If the license is revoked or expired, the sync deletes license.json from SharePoint so the next runtime check reaches Tier 3 (API) and returns the correct denied result.

Usage Metrics Storage

Usage metrics are stored as monthly aggregate counters keyed by licenseKey. Metrics do not contain document content, user identities, file names, document metadata, or workflow payloads.

• Aggregated: Rolling monthly totals (reset on month boundaries), not per-document or per-user.
• Tenant-identifiable: Keyed by licenseKey, which is cryptographically bound to your tenantId during license activation.
• Restricted purpose: Usage metrics sent to the REFRACT PDF Licensing API are used only for licensing enforcement. They are not included in telemetry or shared with third parties.

Entitlement File Storage

The license.json entitlement file is stored in your SharePoint document library. It is cryptographically signed using JWS ES256 (ECDSA P-256): REFRACT PDF holds the private signing key; your Dispatcher Function holds only the public verification key. Any modification to the file causes signature validation to fail and the file is silently discarded, falling through to Tier 3.

Runtime Behavior

The Licensing API is not called on every request. The Dispatcher evaluates the tier cascade in order:

• If the in-memory cache (Tier 1) is valid (< 24 h old), the API is not called.
• If the SharePoint license.json (Tier 2) is present and its JWS signature is valid, the API is not called (non-trial plans).
• If both Tiers 1 and 2 miss or are expired, the Dispatcher calls the Licensing API directly (Tier 3).
• If the API is unreachable and a valid response was received within the last 48 hours, the system continues on the last cached entitlement (Tier 4 grace).

Grace Period

The 48-hour grace period applies only when the Licensing API is temporarily unreachable (network outage, planned maintenance). It does not apply to licenses that are revoked or expired - those return a denied response immediately. After the 48-hour grace window, access is denied until the API is reachable again.

No document content is transmitted during licensing operations at any tier.

---

3. Data Residency

REFRACT PDF deploys entirely into your chosen Azure region, set via the -Location parameter in deploy.ps1. All document data, audit logs, and encryption keys reside in that region.

Refract Logic-operated services:

---

4. Data Retention

Storage lifecycle policy (deployed by default via Bicep, on generated-document and archive containers):

---

5. GDPR Posture

Roles

Lawful Basis

Refract Logic LLC processes document payloads on the instructions of the Data Controller (your organisation). The lawful basis for processing is the performance of a contract (document generation and approval workflow services).

Personal Data in REFRACT PDF

• Approver email addresses are the primary PII processed by REFRACT PDF workflow functions. They are AES-256-GCM encrypted before storage in Azure Table Storage. The encryption key is in your Azure Key Vault.
• Document payload fields may contain personal data depending on your template design. REFRACT PDF treats all payload fields as potentially personal data and applies the same encryption and access controls.
• Portal session IP address is optionally logged in App Insights telemetry for security purposes.

Data Subject Rights

Because all data is stored in your Azure subscription and SharePoint tenant:

• Right of Access - query your Azure Blob Storage and SharePoint via your admin tooling.
• Right to Erasure - delete blobs from Azure Blob Storage; delete list items from SharePoint. Sealed .raudit archives in WORM-locked containers cannot be deleted before retention expiry (by design - required for audit integrity).
• Data Portability - .raudit archives are standard ZIP containers; PDF outputs are standard PDF files.

Cross-Border Transfers

The only cross-border transfer to Refract Logic-operated services transmits license key and tenant ID (non-personal data under GDPR Art. 4(1)) and HMAC tokens (pseudonymous, no identity information). A Data Processing Agreement (DPA) with Refract Logic LLC is available on request at contact@refractlogic.com.

---

6. Breach Notification

In the event of a suspected breach within Refract Logic-operated infrastructure (Licensing API or eSign Portal), Refract Logic LLC will notify affected customers within 72 hours of becoming aware of the incident. See Incident Response for the full procedure.

Because your document data is stored in your own Azure subscription, a breach of Refract Logic-operated infrastructure does not expose your document content. A breach of your Azure subscription is governed by your incident response procedures and Microsoft's contractual obligations under your MCA.

---