SIS-licensed ISO clauses and controls·an add-on inside the AI clients and agents you already use
    See the standards module →
    Use casesPrivacy

    LINDDUN privacy threat model for a customer-data store

    You are adding a new customer-data warehouse. The privacy team wants a LINDDUN-go privacy threat model: linkability, identifiability, non-repudiation, detectability, disclosure of information, unawareness, non-compliance — per data flow.

    Citations10
    Tool calls3
    Captured withclaude-opus-4-7

    How the gateway answered

    Captured 14 May 2026 — a point-in-time run; corpora and tools have been updated since.

    Captured sessionclaude-opus-4-7 · team tier · gateway.ansvar.eu
    You

    Build a LINDDUN-go privacy threat model for the following data flow: SaaS app → ETL service → customer warehouse → BI tool. Show threats per LINDDUN category, mitigations, and cite GDPR / ePrivacy / DPA guidance where relevant.

    Ansvar gateway — 3 tool calls
    search(query="linkability identifiability profiling automated decis…" frameworks=[GDPR] limit=8)→ 8 results: GDPR Art. 22, 13, 14, 15, 20, 21, 47 + Recital 71
    search(query="electronic communications privacy confidentiality coo…" frameworks=[EPRIVACY] limit=6)→ 6 results from ePrivacy Directive — Art. 5 + Recitals 4, 6, 21, 33, 46
    search(query="data protection impact assessment large-scale systema…" frameworks=[GDPR] limit=6)→ 6 results: GDPR Art. 35, 37 + Recitals 72, 90, 91, 97
    Cited answer

    LINDDUN-go threat model — SaaS app → ETL → customer warehouse → BI tool

    Four pipeline stages, seven LINDDUN-go categories. Each row maps a privacy threat to the cited control. The GDPR coverage in this run is strong; ePrivacy is relevant only at the SaaS-collection edge.

    L — Linkability

    Distinct records can be tied back to the same person across the pipeline even when no direct identifier is present.

    StageThreatCited control
    SaaS appSession IDs + IP + UA fingerprint sufficient to re-identifyGDPR Art. 5 (data minimisation, storage limitation)
    ETLJoin keys exposed across previously isolated datasetsGDPR Art. 35 (DPIA for systematic large-scale evaluation)
    WarehouseCross-table joins enable singling-outGDPR Recital 91 (DPIA explicitly required for systematic + extensive profiling)
    BISmall-cohort filters reveal individualsAggregation thresholds (k-anonymity); no on-point gateway citation in this run

    I — Identifiability

    A pseudonymous record becomes identifiable.

    StageThreatCited control
    SaaS appEmail + name collected when not neededGDPR Art. 5 (purpose limitation, minimisation)
    …
    Download PDFDownload Markdown

    Every claim traces to a source you can open

    A typical AI assistant invents a citation that looks plausible. Ansvar retrieves the real one. Every finding above rests on one of these 10 sources — official legislation — linked wherever the source is publicly reachable; catalog rows served through the gateway are quoted as fetched. No citation is fabricated — every source was retrieved through Ansvar and can be checked.

    Run this on your own data

    This is available as a service: Threat Model as a Service. Bring your own documents and scope, and we'll run it end-to-end — every finding cited and validated by the expert who delivers it.

    See the coverage behind this run on the Privacy & data protection sector page.