Data Flow

This document describes, end to end, how data moves between a brand's infrastructure and Maya. Every component is named. Every transformation is identified. Every actor and their controls are stated.

Principle

Maya never receives raw logs. The brand applies the filter and minimization rules inside its own perimeter, and Maya only ever receives the post-filter output.

This is the inverse of the typical SaaS pattern (where the SaaS receives the raw event stream and filters server-side). For regulated industries — particularly banking — this inversion is a hard requirement.

Diagram (logical)

┌─────────────────────────────────────────────────────────────────────┐
│                       BRAND INFRASTRUCTURE                          │
│                                                                     │
│   ┌────────────────┐    ┌────────────────┐    ┌────────────────┐   │
│   │  Web Server    │    │  Filter Layer  │    │  Egress Stage  │   │
│   │  (IIS / Nginx  │───▶│  (SQL / Power  │───▶│  (PowerShell / │   │
│   │   / BFF)       │    │   Shell / BFF  │    │   curl / SFTP) │   │
│   │                │    │   middleware)  │    │                │   │
│   └────────────────┘    └────────────────┘    └────────────────┘   │
│        ▲ all traffic        ▲ filter applied      ▲ outbound       │
│        │ (users + bots)     │ (bots only,         │ over TLS 1.3   │
│        │                    │  PII stripped)      │                │
└────────┼────────────────────┼─────────────────────┼────────────────┘
         │                    │                     │
         │                    │                     │
         │                    │                     ▼
         │                    │             ┌────────────────┐
         │                    │             │  Maya          │
         │                    │             │  Ingestion API │
         │                    │             │  (POST /v1/    │
         │                    │             │   logs)        │
         │                    │             └────────────────┘
         │                    │                     │
         │                    │                     ▼
         │                    │             ┌────────────────┐
         │                    │             │  Maya          │
         │                    │             │  Per-tenant    │
         │                    │             │  storage       │
         │                    │             │  (encrypted)   │
         │                    │             └────────────────┘
         │                    │                     │
         │                    │                     ▼
         │                    │             ┌────────────────┐
         │                    │             │  Brand         │
         │                    │             │  dashboard     │
         │                    │             │  (read-only,   │
         │                    │             │   per-tenant)  │
         │                    │             └────────────────┘
         │                    │
         ▼                    ▼
   Bank-controlled.    Bank-controlled.
   Maya never has     Maya provides the
   read access.       template; the brand
                      writes/approves the
                      final query.

Stages

Stage 1 — Ingestion (inside the brand)

Web servers (IIS, Nginx, Apache, or the BFF layer) record all traffic per their normal operating procedures. Maya does not change this. Maya does not require any new logging to be enabled.

Stage 2 — Filter (inside the brand)

A scheduled job runs on the brand's infrastructure. It reads recent logs and applies:

1. User-Agent allowlist filter. Only requests whose User-Agent matches the verified LLM bot list (see Data Minimization) are retained.
2. PII strip. Fields known to potentially carry PII are dropped or hashed:
   • IP address → hashed (HMAC-SHA256 with a per-tenant secret) or dropped entirely.
   • Query strings stripped of sensitive parameters.
   • Cookies, authentication headers, request bodies excluded.
3. Field projection. Only the allowlisted output schema is produced.

Maya provides reference filter implementations (PowerShell for IIS, awk/jq for Nginx, etc.). The brand's IT team reviews, may modify, and approves the final query before deployment. The query is auditable.

Stage 3 — Egress (inside the brand)

The filtered batch is transmitted to Maya. Two patterns are supported:

In both patterns, the transport is TLS 1.3. Authentication uses long-lived API keys for batch upload, or mTLS for endpoint pull.

Stage 4 — Storage (Maya)

Filtered logs are stored in Maya's per-tenant data store. Properties:

• Encryption at rest: AES-256.
• Per-tenant logical isolation; no cross-tenant queries possible.
• Configurable retention (default 13 months; customer-specified retention available).
• No replication outside the contracted region.

Stage 5 — Analysis (Maya)

Maya runs analytics on the filtered logs:

• Bot crawl frequency per page.
• Bot-by-page heatmaps.
• Crawl-error detection.
• Cross-correlation with prompt simulation results.

No raw analysis output is shared outside the tenant.

Stage 6 — Presentation (Maya → brand)

The brand accesses results via:

• Maya dashboard (web UI, SSO-capable).
• API (GET /v1/insights, scoped to the tenant).
• Periodic reports (PDF or email digest, opt-in).

Controls

Verifying the data flow

Three independent checks let the brand confirm Maya never receives raw logs:

1. Source-side audit. Run the filter query in audit mode (--dry-run), inspect the output, confirm it contains only allowlisted fields.
2. Network audit. Capture egress traffic to Maya for a sampling window. Confirm no requests outside the egress job and no payloads containing disallowed fields.
3. Maya audit endpoint. Maya exposes GET /v1/audit/ingested returning a sampled view of recently ingested records, scoped to the tenant. The brand can compare to the source-side audit output.

Out of scope

Maya does not ingest, process, or store:

• Application database content
• Customer records of any kind
• Internal banking APIs
• POST request bodies
• Authentication or session state
• Cookies
• Any PII as defined under KVKK Article 3

For the explicit allowlist, see Data Minimization.

For the explicit denylist, see What Maya Does Not Collect.