V7 section 62
Twelve fail-closed acceptance criteria
Visitors receive only the broad public viewLocal synthetic coverage · external validation required
Detail data requires a valid server-side sessionLocal synthetic coverage · external validation required
Registration is limited to necessary account and survey dataLocal synthetic coverage · external validation required
Marketing is optional and off by defaultLocal synthetic coverage · external validation required
Access is never coupled to personal-data sale or transferLocal synthetic coverage · external validation required
Consent is separate, versioned and withdrawableLocal synthetic coverage · external validation required
Account deletion starts a documented workflowLocal synthetic coverage · external validation required
Retention jobs delete or anonymise under a defined ruleLocal synthetic coverage · external validation required
Raw exports are blocked or require documented human reviewLocal synthetic coverage · external validation required
Aggregates pass minimum-cell and disclosure controlsLocal synthetic coverage · external validation required
Compliance monitoring accepts approved official sources onlyLocal synthetic coverage · external validation required
Legal changes create review tickets, never automatic production updatesLocal synthetic coverage · external validation required
Outside the local coding scope
External release gates remain open
qualified legal reviewHuman evidence required · cannot be self-approved by the application
independent security reviewHuman evidence required · cannot be self-approved by the application
processor and transfer reviewHuman evidence required · cannot be self-approved by the application
hosted staging validationHuman evidence required · cannot be self-approved by the application
explicit operator activationHuman evidence required · cannot be self-approved by the application