Audit, research consent + deletion
Every scored request lands in an audit row. Tenants who opt into the research programme contribute anonymised aggregates to the public forecast-verification dataset. GDPR Article 17 deletion scrubs personally-attributable records on demand.
What gets logged
Every /v1/score call writes a row to the scoring audit log with: request hash, full weather sample, provider chain, deterministic score, verdict, breakdown, forecast horizon, and the cohort hash that identifies the sample set. Outcomes (POST /v1/score/:id/outcome) join against the audit row via sessionId. Test keys are flagged in the audit log and excluded from billing + research.
Research consent
The audit log is tenant-private by default. Tenants who opt in via research_consent = true on their tenant record contribute anonymised aggregates to the public dataset (see Streams A through G at the research page). What anonymisation does:
- k-anonymity floor ≥ 10 — no cell published until 10 distinct contributors join it.
- Spatial truncation to a 1km² grid — exact spot coordinates are never published; the grid cell is.
- Temporal lag of 90 days — the freshest 90 days are held back so individual sessions can't be timestamp-reconstructed.
- Cohort hash anchoring — every published aggregate carries the deterministic weather-sample hash so researchers can replay the calculation against their own ERA5 mirror.
Deletion (GDPR Article 17)
Pseudonyms can be erased on request via DELETE /v1/decision/user-data/:pseudonym. The endpoint scrubs every personally-attributable row (behavioral model, decision-runs, non-aggregate audit), returns 204 with three receipt headers (X-Anonymized-Rows, X-Anonymized-Decision-Runs, X-Receipt), and leaves Recital 26 anonymous aggregates intact.
For tenant-level deletion (the whole tenant departing the platform), reach out to ops — there are downstream caches and per-tenant Stripe objects that need orderly teardown. The data deletion log table retains the operation receipt for compliance.
Public exports
Three CC BY 4.0 exports land at goable.io once you've opted in:
/v1/research/verification/export.jsonl— daily Brier Skill Score per (activity × cell × horizon), k≥10 + 90-day lag./v1/research/difficulty-atlas/export.jsonl— per-spot difficulty distribution from the skill-conditioned scoring./v1/research/export.jsonl— the unified Stream-A dataset for calibration partners.