Docs·Concepts·Audit + research

Audit, research consent + deletion

Every scored request lands in an audit row. Tenants who opt into the research programme contribute disclosure-controlled aggregates to the public forecast-verification dataset, released only where reference data and coverage permit. GDPR Article 17 deletion scrubs personally-attributable records on request; Goable acts as processor on tenant data.

What gets logged

Every /v1/score call writes a row to the scoring audit log (when the deployment has DATABASE_URL configured) with: the full raw weather sample set, provider chain, engine version, deterministic score, verdict, breakdown, alerts, forecast horizon, and (when a sub-spot resolves) the calibration level + tier provenance. Outcomes (POST /v1/score/:id/outcome) join against the audit row via the score response's session_id. Test keys are flagged in the audit log and excluded from billing + research.

Research consent

The audit log is tenant-private by default. Tenants who opt in via research_consent = true on their tenant record contribute disclosure-controlled aggregates to the public dataset (see Streams A through G at the research page). These are minimum disclosure controls, not a guarantee of anonymity: aggregated and pseudonymous data can still be personal data under GDPR Recital 26, so a release also passes a disclosure-control review. What the controls do:

k-anonymity floor ≥ 10: no cell published until 10 distinct contributors join it.
Spatial truncation to a 1km² grid: exact spot coordinates are never published; the grid cell is.
Temporal lag of 90 days: the freshest 90 days are held back so individual sessions can't be timestamp-reconstructed.
Cohort hash anchoring: the difficulty-atlas export (below) anchors each row to a cohort_hash identifying the skill-calibration fit it came from, so researchers can verify reproducibility against the same input cohort.

Deletion (GDPR Article 17)

Pseudonyms can be erased on request via DELETE /v1/decision/user-data/:pseudonym. The endpoint scrubs every personally-attributable row (behavioral model, decision-runs, skill posteriors, recommendation runs, non-aggregate audit), returns 204 with five receipt headers (X-Anonymized-Rows, X-Anonymized-Decision-Runs, X-Anonymized-Skill-Posteriors, X-Anonymized-Recommendation-Runs, X-Receipt), and leaves disclosure-controlled aggregates intact.

For tenant-level deletion (the whole tenant departing the platform), reach out to ops: there are downstream caches and per-tenant Stripe objects that need orderly teardown. The data deletion log table retains the operation receipt for compliance.

Public exports

Three CC BY 4.0 exports land at goable.io once you've opted in and a release clears the disclosure controls. Each release identifies its coverage, reference data, sample size, metrics and limitations. The Brier Skill Score measures forecast quality against a reference; it is not a claim that a suitability score is universally accurate.

/v1/research/verification/export: daily Brier Skill Score per (activity × cell × horizon), k≥10 + 90-day lag.
/v1/research/difficulty-atlas/export.jsonl: per-spot difficulty distribution from the skill-conditioned scoring.
/v1/research/export.jsonl: the unified Stream-A dataset for calibration partners.