Public service status
Online complaints, membership expressions of interest, enquiries and participation submissions are temporarily closed. This public website has no collection forms, submission database or administrative access. Procedures describing intake or record handling are proposals for a future service.
Separate the records
Public documents are versioned with the source. This information edition has no submission database and collects no form or demonstration records. Private development data is never bundled into the public website.
Administrative audit records contain record identifiers, actor identifiers and status changes; they should not duplicate free-text complaints. Raw IP addresses are not stored in the application database. Short-lived rate-limit keys are hashed.
Define retention before launch
The operator must approve purpose-specific retention periods, deletion responsibilities, legal holds and backup expiry. Indefinite collection is not a default policy. Data minimisation includes exports and developer test copies.
This public information edition creates no complaint records. Before any future intake service opens, retention and deletion procedures require a reviewed policy, backup plan and separate authorisation.
Access and recovery
Limit administration to authorised identities and verify tokens on the server. Store exports securely outside the production environment, encrypt them and test restoration into an isolated store. Treat backup access as access to the original personal data.
A Worker rollback changes code; it does not restore D1 records. Recovery plans must cover source, assets, database and identity configuration separately.