Data Protection Impact Assessments

Mintstone retrieves bank transactions from borrowers' accounts via TrueLayer (FCA-authorised Open Banking provider) to verify drawdown expenditure, monitor construction costs against budgets, and check loan covenant compliance. Transactions are automatically classified into spend categories using OpenAI's API (zero-retention) to match them against JCT budget line items.

• Data collected: Account holder name, sort code, account number, IBAN, transaction descriptions, amounts, dates, running balances
• Processing applied: AI-assisted spend classification (mappedCategory, aiMatchConfidence, aiMatchReason), budget variance analysis, drawdown verification
• Data subjects: Property developers (borrowers) and bank account holders connected to monitored projects
• Volume: Typically 1–50 bank accounts per lender, refreshed via Open Banking every 24 hours during active monitoring
• Retention: 7 years from transaction date (REGULATORY_7Y)

Lawful basis: Article 6(1)(b) Contract (necessary for loan monitoring service) and Article 6(1)(c) Legal obligation (regulatory record-keeping).

• Necessity: Lenders are contractually required to monitor how borrowers spend loan funds. Open Banking provides real-time, verified transaction data directly from the bank, replacing manual PDF statement uploads which are slower, less reliable, and can be manipulated
• Proportionality: Only accounts explicitly connected by the lender are monitored. TrueLayer consent expires after 90 days, requiring active re-consent. Only transaction data is retrieved; no access to other banking products, credit cards, or savings
• Data minimisation: Transaction descriptions are sent to OpenAI for classification only; no account holder names or account numbers are included in AI API calls
• Purpose limitation: Data is used solely for loan monitoring and regulatory compliance; never for credit scoring, marketing, or sharing with third parties

• Consent management: TrueLayer consent tokens expire after 90 days; automatic re-consent required; consent status tracked in database (consentToken, consentStatus, consentExpiresAt)
• Data minimisation for AI: Only transaction description text sent to OpenAI; account holder PII excluded from API calls
• Human review: All AI classifications displayed with confidence scores; lender users review and can override any classification
• Encryption: AES-256 at rest (AWS RDS eu-west-2); TLS 1.3 in transit; TrueLayer consent tokens encrypted in database
• Access control: RBAC with project-level scoping; bank data visible only to authorised lender users assigned to that project
• Audit trail: SHA-256 hash-chained immutable log of all access to and changes in bank transaction data
• Retention enforcement: Automated REGULATORY_7Y retention category; deletion logged in audit trail
• Sub-processor controls: DPAs with TrueLayer and OpenAI; breach notification ≤ 48 hours; annual sub-processor review

✅ DPIA Outcome

Residual risk is acceptable. The combination of FCA-regulated Open Banking consent, zero-retention AI processing, data minimisation, human review of all outputs, and robust encryption/access controls reduces risk to a level that does not require consultation with the ICO under Article 36. Processing may proceed.

Mintstone uses AI services (OpenAI, Anthropic) to extract and analyse structured data from construction documents uploaded by lender staff and contractors. Anthropic Claude handles primary OCR and invoice extraction; OpenAI GPT-4o provides fallback OCR and Vision-based text extraction. This includes invoices, QS reports, professional certificates, valuations, and site photographs.

• Data collected: Uploaded document contents including names, company details, signatures, invoice amounts, certifications; site photographs which may incidentally capture individuals
• Processing applied: OCR text extraction, AI-powered data structuring, anomaly detection, budget line item matching, certificate verification
• Data subjects: Property developers, contractors, subcontractors, professional advisors (surveyors, QS, architects), individuals incidentally captured in site photographs
• Volume: Typically 10–200 documents per project, uploaded throughout the loan lifecycle
• Retention: 7 years from upload date (REGULATORY_7Y)

Lawful basis: Article 6(1)(b) Contract (necessary for loan monitoring) and Article 6(1)(f) Legitimate interests (efficient document processing; see LIA).

• Necessity: ADC loan monitoring requires analysis of hundreds of construction documents per project. Manual extraction is too slow for continuous monitoring and prone to human error in financial calculations
• Proportionality: AI processing is applied only to documents voluntarily uploaded for the purpose of loan monitoring. Only relevant document sections are sent to AI processors; full documents are not transmitted in their entirety where it is practical to segment
• Data minimisation: AI outputs extract only structured data fields needed for monitoring (amounts, dates, names, categories). Raw document content is not stored by AI sub-processors (zero-retention agreements)
• Site photographs: Photos may incidentally capture individuals on construction sites. These images are processed for construction progress assessment only; no facial recognition, biometric analysis, or individual identification is performed

• Zero-retention AI: Both AI sub-processors (OpenAI, Anthropic) operate under zero-retention agreements; customer data is not stored, logged, or used for model training
• Data minimisation: Where practical, only relevant sections of documents are sent to AI processors rather than entire files
• Human review: All AI-extracted data is presented to lender users for review before any monitoring decision is influenced by it
• Document storage: Original documents stored in AWS S3 eu-west-2 with AES-256 server-side encryption; access via pre-signed URLs with configurable time limits
• Access control: RBAC ensures documents are visible only to users authorised on the specific project; no cross-project document access
• Photo safeguards: GPS coordinates and timestamps extracted from EXIF for site verification, then non-essential metadata (camera model, lens, device serial) stripped via sharp before S3 storage (Article 5(1)(c) data minimisation)
• Upload security: File type validation via magic-byte header inspection (prevents disguised-extension attacks); MIME type allowlisting; maximum file size limits (10–25 MB per context)
• Audit trail: All document uploads, AI processing events, and human review actions logged in SHA-256 hash-chained immutable audit log
• Sub-processor governance: DPAs with all AI sub-processors; annual review of sub-processor security posture; breach notification ≤ 48 hours
• Retention: Automated REGULATORY_7Y retention enforcement; secure deletion via S3 lifecycle policies and database cascade purge

✅ DPIA Outcome

Residual risk is acceptable. The combination of zero-retention AI processing, data minimisation, mandatory human review of all outputs, encrypted storage, RBAC, and comprehensive audit logging reduces risk to a level that does not require consultation with the ICO under Article 36. Processing may proceed.