elonmasai7/PrivacyOps

PrivacyOps Africa helps African startups automate privacy checks, compliance readiness, security reviews, evidence collection, and reports for Kenya DPA, GDPR, SOC 2, and ISO 27001, making it easier to prove customer data is handled safely. # PrivacyOps Africa Core PrivacyOps Africa Core is an open-source, self-hostable privacy, compliance, and security readiness platform built for African startups, SMEs, NGOs, and engineering teams. It helps organizations operate practical readiness programs for: - Kenya Data Protection Act (DPA) - GDPR - SOC 2 readiness - ISO 27001 readiness ## Why this exists Privacy and security tooling is often expensive, opaque, or designed for non-African regulatory realities. PrivacyOps Africa Core is designed to be inspectable, configurable, and community-maintained so local teams can run trustworthy readiness workflows with real data. ## Application architecture - **Presentation layer**: Next.js workspace UI (`frontend/app`) with role-aware module navigation and real-data forms. - **API layer**: FastAPI routers (`backend/app/routers`) expose module-bounded endpoints (auth, frameworks, workflows, reports, integrations, admin). - **Service layer**: Core business logic (`backend/app/services.py`) handles readiness scoring, scanning integrations, report generation, and audit helpers. - **Data layer**: SQLAlchemy domain models (`backend/app/models.py`) persist tenants, controls, evidence, workflows, findings, and logs in PostgreSQL. - **Operations layer**: Docker Compose (`docker-compose.yml`), export/upload storage, and CI workflows (`.github/workflows/ci.yml`) support self-hosted delivery. Full architecture and lifecycle visuals are in `docs/architecture.md`. ## What this project does - Organization workspaces with RBAC, audit logs, onboarding, and readiness scoring. - Framework registry with versioned framework packs and review status (`community-reviewed`, `expert-reviewed`, `unverified`). - Data inventory (RoPA), DPIA workflow, DSR workflow, incident workflow, vendor workflow, policy workflow, evidence vault, tasks, and trust center foundations. - Full CRUD/filter/export parity for DSR, incidents, vendors, policies, and tasks. - Real report generation/export (`P …