feat(B-SENS): Sensitive Data Boundary + AI/Data Exposure Policy + AIProvider Compliance

B-SENS: app/core/sensitive_data.py (NEU) — zentrale Sensitive-Field-Verwaltung
- SENSITIVE_FIELDS dict für contact/user/mail_account/system_settings
- is_sensitive(), sanitize_dict(), register_sensitive_fields()
- Integration: errors.py (Log-Redaction), audit.py (Audit-Masking), export_service.py (Export-Filter), embedding.py (Index-Filter)

B-DATA-POL: AI/Data Exposure Policy
- DATA_EXPOSURE_POLICY: pro Entity+Field welche Systeme erlaubt (llm_context/search/embeddings/rag/agent_memory/export)
- filter_for_llm_context/search/embeddings/export/rag/agent_memory()

B-AIPROV-COMP: AIProvider Compliance Metadata
- Migration 0119: 7 neue Spalten an ai_providers (region, hosting_type, dpa_status, retention_policy, training_on_customer_data, transfer_notice, allowed_data_classes)
- llm_client.py: get_provider_compliance() + check_data_class_allowed()

B-PRIV-TEST: 76 Tests in test_sensitive_data.py — alle grün
- Sensitive Fields, Exposure Policy, Provider Compliance, Secrets-always-blocked
- Keine Regression: 39 LLM-Client Tests grün

app/ai/llm_client.py

@@ -131,6 +131,60 @@ async def get_api_credentials(
     return (env_key if env_key else None), None, None
 
 
+async def get_provider_compliance(
+    db: AsyncSession | None,
+    tenant_id: uuid.UUID | None,
+) -> dict[str, Any] | None:
+    """Get compliance metadata for the active AI provider.
+
+    Returns a dict with keys: ``region``, ``hosting_type``, ``dpa_status``,
+    ``retention_policy``, ``training_on_customer_data``, ``transfer_notice``,
+    ``allowed_data_classes``.
+
+    Returns ``None`` if no DB provider is configured (env-based fallback).
+    """
+    if not (db and tenant_id):
+        return None
+    try:
+        from app.plugins.builtins.ai_assistant.contracts import get_default_provider
+
+        provider = await get_default_provider(db, tenant_id)
+        if provider is None:
+            return None
+        return {
+            "region": getattr(provider, "region", "unknown"),
+            "hosting_type": getattr(provider, "hosting_type", "cloud"),
+            "dpa_status": getattr(provider, "dpa_status", "none"),
+            "retention_policy": getattr(provider, "retention_policy", ""),
+            "training_on_customer_data": getattr(provider, "training_on_customer_data", False),
+            "transfer_notice": getattr(provider, "transfer_notice", ""),
+            "allowed_data_classes": getattr(provider, "allowed_data_classes", []),
+        }
+    except Exception:
+        logger.debug("Failed to get provider compliance metadata")
+        return None
+
+
+def check_data_class_allowed(
+    compliance: dict[str, Any] | None,
+    data_class: str,
+) -> bool:
+    """Check whether the configured provider may process *data_class*.
+
+    Uses :func:`app.core.sensitive_data.check_provider_compliance`.
+    Returns ``True`` if compliance metadata is unavailable (fail-open for
+    backward compatibility and mock mode).
+    """
+    from app.core.sensitive_data import check_provider_compliance
+
+    if compliance is None:
+        return True
+    return check_provider_compliance(
+        compliance.get("allowed_data_classes"),
+        data_class,
+    )
+
+
 def build_model(model: str, provider_type: str | None) -> str:
     """Build LiteLLM model string with provider prefix.
 

app/core/audit.py

@@ -21,14 +21,21 @@ async def log_audit(
     changes: dict[str, Any] | None = None,
     details: dict[str, Any] | None = None,
 ) -> AuditLog:
-    """Create an audit log entry."""
+    """Create an audit log entry.
+
+    Sensitive fields in *changes* are masked using the central
+    :mod:`app.core.sensitive_data` module.
+    """
+    from app.core.sensitive_data import sanitize_dict
+
+    masked_changes = sanitize_dict(changes, entity_type) if changes else changes
     entry = AuditLog(
         tenant_id=tenant_id,
         user_id=user_id,
         action=action,
         entity_type=entity_type,
         entity_id=entity_id,
-        changes=changes,
+        changes=masked_changes,
     )
     db.add(entry)
     await db.flush()
@@ -46,14 +53,19 @@ async def log_deletion(
     """Create a deletion history entry (merged from DeletionLog into EntityHistory).
 
     Stores the full entity snapshot in snapshot_before for forensic recovery.
+    Sensitive fields are masked using the central
+    :mod:`app.core.sensitive_data` module.
     """
+    from app.core.sensitive_data import sanitize_dict
+
+    masked_snapshot = sanitize_dict(entity_snapshot, entity_type)
     entry = EntityHistory(
         tenant_id=tenant_id,
         user_id=user_id,
         entity_type=entity_type,
         entity_id=entity_id,
         action="delete",
-        snapshot_before=entity_snapshot,
+        snapshot_before=masked_snapshot,
         snapshot_after=None,
         changes=None,
         owner_id=user_id,

app/core/sensitive_data.py

@@ -0,0 +1,303 @@
+"""Central sensitive-data boundary — field redaction and data-exposure policy.
+
+Provides a single source of truth for which entity fields are sensitive
+and which downstream systems (LLM context, search, embeddings, RAG,
+agent memory, export) are allowed to receive them.
+
+This module does **not** replace ``permission_registry.py`` or the
+``sensitivity`` field in ``manifest.py``; it respects their classifications
+but adds a central enforcement layer at the points where data leaves the
+system (logs, exports, index, embeddings, LLM context).
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+# ──────────────────────────────────────────────────────────────────────────
+# SENSITIVE_FIELDS — fields that must NEVER appear in external outputs
+# ──────────────────────────────────────────────────────────────────────────
+
+SENSITIVE_FIELDS: dict[str, set[str]] = {
+    "contact": {
+        "password_hash",
+        "smtp_password",
+        "imap_password",
+        "api_key",
+        "oauth_token",
+        "session_token",
+        "encryption_key",
+    },
+    "user": {
+        "password_hash",
+        "api_key",
+        "session_token",
+    },
+    "mail_account": {
+        "smtp_password",
+        "imap_password",
+        "oauth_token",
+    },
+    "system_settings": {
+        "secret_key",
+        "encryption_key",
+    },
+}
+
+_REDACTED = "***REDACTED***"
+
+# ──────────────────────────────────────────────────────────────────────────
+# DATA_EXPOSURE_POLICY — per entity+field, which systems may receive data
+# ──────────────────────────────────────────────────────────────────────────
+
+# Schema: {entity_type: {field_name: {system: bool}}}
+# Systems: llm_context, search, embeddings, rag, agent_memory, export
+#
+# Default derivation from sensitivity levels:
+#   normal   → all systems allowed
+#   sensitive → only export (with permission)
+#   critical → nothing allowed
+#
+# Fields listed in SENSITIVE_FIELDS are always blocked everywhere regardless
+# of any policy entry.
+
+_EXPOSURE_SYSTEMS = (
+    "llm_context",
+    "search",
+    "embeddings",
+    "rag",
+    "agent_memory",
+    "export",
+)
+
+_ALL_ALLOWED = {s: True for s in _EXPOSURE_SYSTEMS}
+_ALL_BLOCKED = {s: False for s in _EXPOSURE_SYSTEMS}
+_EXPORT_ONLY = {s: (s == "export") for s in _EXPOSURE_SYSTEMS}
+
+# Explicit overrides for specific entity+field combinations.
+# Fields not listed here derive their policy from the sensitivity level
+# (see ``_derive_policy_from_sensitivity``).
+DATA_EXPOSURE_POLICY: dict[str, dict[str, dict[str, bool]]] = {
+    "contact": {
+        # Sensitive financial fields — allowed in export with permission,
+        # blocked from LLM/embeddings/search.
+        "code": _EXPORT_ONLY,
+        "accounting_code": _EXPORT_ONLY,
+        "vendor_accounting_code": _EXPORT_ONLY,
+        "vat_code": _EXPORT_ONLY,
+        "fiscal_code": _EXPORT_ONLY,
+        "commerce_code": _EXPORT_ONLY,
+        "purchase_number": _EXPORT_ONLY,
+        "bic": _EXPORT_ONLY,
+        "mobilephone": _EXPORT_ONLY,
+        "notes": _EXPORT_ONLY,
+        "tags": _EXPORT_ONLY,
+    },
+}
+
+# Sensitivity level → default exposure policy
+_SENSITIVITY_DEFAULTS: dict[str, dict[str, bool]] = {
+    "normal": _ALL_ALLOWED,
+    "sensitive": _EXPORT_ONLY,
+    "critical": _ALL_BLOCKED,
+}
+
+
+# ──────────────────────────────────────────────────────────────────────────
+# Sensitive-field helpers
+# ──────────────────────────────────────────────────────────────────────────
+
+
+def get_sensitive_fields(entity_type: str) -> set[str]:
+    """Return the set of sensitive field names for *entity_type*.
+
+    Returns an empty set if the entity type is not registered.
+    """
+    return set(SENSITIVE_FIELDS.get(entity_type, set()))
+
+
+def is_sensitive(entity_type: str, field_name: str) -> bool:
+    """Check whether *field_name* is sensitive for *entity_type*."""
+    return field_name in SENSITIVE_FIELDS.get(entity_type, set())
+
+
+def sanitize_dict(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Return a copy of *data* with sensitive fields replaced by ``***REDACTED***``.
+
+    Non-sensitive fields are preserved as-is.  Nested dicts are processed
+    recursively.  The original dict is not mutated.
+    """
+    sensitive = SENSITIVE_FIELDS.get(entity_type, set())
+    result: dict[str, Any] = {}
+    for key, value in data.items():
+        if key in sensitive:
+            result[key] = _REDACTED
+        elif isinstance(value, dict):
+            result[key] = sanitize_dict(value, entity_type)
+        else:
+            result[key] = value
+    return result
+
+
+def register_sensitive_fields(entity_type: str, fields: set[str]) -> None:
+    """Register additional sensitive fields for *entity_type*.
+
+    Plugins call this at startup to declare their own sensitive fields.
+    Merges with any existing fields for the entity type.
+    """
+    existing = SENSITIVE_FIELDS.setdefault(entity_type, set())
+    existing |= fields
+    logger.debug(
+        "Registered sensitive fields for %s: %s", entity_type, fields
+    )
+
+
+# ──────────────────────────────────────────────────────────────────────────
+# Data-exposure policy helpers
+# ──────────────────────────────────────────────────────────────────────────
+
+
+def _derive_policy_from_sensitivity(
+    entity_type: str, field_name: str
+) -> dict[str, bool]:
+    """Derive a default exposure policy from the permission registry.
+
+    Falls back to ``_ALL_ALLOWED`` if no sensitivity information is
+    available for the field.
+    """
+    # Check explicit policy first
+    entity_policy = DATA_EXPOSURE_POLICY.get(entity_type, {})
+    if field_name in entity_policy:
+        return dict(entity_policy[field_name])
+
+    # Try to get sensitivity from permission registry (lazy import to avoid
+    # circular dependencies at module load time).
+    try:
+        from app.core.permission_registry import CORE_FIELD_DEFINITIONS
+
+        for fd in CORE_FIELD_DEFINITIONS:
+            if fd.get("module") == entity_type and fd.get("field") == field_name:
+                sensitivity = fd.get("sensitivity", "normal")
+                return dict(_SENSITIVITY_DEFAULTS.get(sensitivity, _ALL_ALLOWED))
+    except Exception:
+        pass
+
+    # Unknown field — default to all allowed (fail-open for normal data)
+    return dict(_ALL_ALLOWED)
+
+
+def get_exposure_policy(entity_type: str, field_name: str) -> dict[str, bool]:
+    """Return the exposure policy dict for *entity_type* / *field_name*.
+
+    The returned dict has keys: ``llm_context``, ``search``, ``embeddings``,
+    ``rag``, ``agent_memory``, ``export`` — each mapped to a bool.
+
+    Fields listed in :data:`SENSITIVE_FIELDS` are always fully blocked.
+    """
+    # Sensitive fields are always blocked everywhere
+    if is_sensitive(entity_type, field_name):
+        return dict(_ALL_BLOCKED)
+
+    return _derive_policy_from_sensitivity(entity_type, field_name)
+
+
+def _filter_for_system(
+    data: dict[str, Any], entity_type: str, system: str
+) -> dict[str, Any]:
+    """Generic filter — remove fields whose policy disallows *system*."""
+    sensitive = SENSITIVE_FIELDS.get(entity_type, set())
+    result: dict[str, Any] = {}
+    for key, value in data.items():
+        # Always block sensitive fields
+        if key in sensitive:
+            continue
+        policy = get_exposure_policy(entity_type, key)
+        if policy.get(system, False):
+            if isinstance(value, dict):
+                result[key] = _filter_for_system(value, entity_type, system)
+            else:
+                result[key] = value
+    return result
+
+
+def filter_for_llm_context(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Remove fields not allowed for LLM context."""
+    return _filter_for_system(data, entity_type, "llm_context")
+
+
+def filter_for_search(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Remove fields not allowed for search / index."""
+    return _filter_for_system(data, entity_type, "search")
+
+
+def filter_for_embeddings(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Remove fields not allowed for embedding generation."""
+    return _filter_for_system(data, entity_type, "embeddings")
+
+
+def filter_for_export(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Remove fields not allowed for data export."""
+    return _filter_for_system(data, entity_type, "export")
+
+
+def filter_for_rag(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Remove fields not allowed for RAG pipelines."""
+    return _filter_for_system(data, entity_type, "rag")
+
+
+def filter_for_agent_memory(data: dict[str, Any], entity_type: str) -> dict[str, Any]:
+    """Remove fields not allowed for agent memory persistence."""
+    return _filter_for_system(data, entity_type, "agent_memory")
+
+
+# ──────────────────────────────────────────────────────────────────────────
+# AI-provider compliance helpers
+# ──────────────────────────────────────────────────────────────────────────
+
+# Data classes that providers may be approved to process
+KNOWN_DATA_CLASSES = (
+    "public",
+    "internal",
+    "sensitive",
+    "critical",
+)
+
+
+def check_provider_compliance(
+    allowed_data_classes: list[str] | None,
+    data_class: str,
+) -> bool:
+    """Check whether a provider is allowed to process *data_class*.
+
+    Args:
+        allowed_data_classes: The provider's ``allowed_data_classes`` list.
+            ``None`` or empty means no restriction (fail-open for backward
+            compatibility).
+        data_class: One of :data:`KNOWN_DATA_CLASSES`.
+
+    Returns:
+        ``True`` if the provider is allowed or unconfigured.
+    """
+    if not allowed_data_classes:
+        return True
+    return data_class in allowed_data_classes
+
+
+def get_data_class_for_field(entity_type: str, field_name: str) -> str:
+    """Determine the data class (public/internal/sensitive/critical) for a field.
+
+    Used by LLM client to check provider compliance before sending data.
+    """
+    if is_sensitive(entity_type, field_name):
+        return "critical"
+    policy = get_exposure_policy(entity_type, field_name)
+    if not any(policy.values()):
+        return "critical"
+    if policy.get("export") and not policy.get("llm_context"):
+        return "sensitive"
+    if all(policy.values()):
+        return "public"
+    return "internal"

app/plugins/builtins/ai_assistant/models.py

@@ -43,6 +43,15 @@ class AIProvider(Base, TenantMixin):
     is_default: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
     config: Mapped[dict] = mapped_column(JSONB, nullable=False, default=dict)
 
+    # ── Compliance metadata (B-AIPROV-COMP) ──
+    region: Mapped[str] = mapped_column(String(20), nullable=False, default="unknown")
+    hosting_type: Mapped[str] = mapped_column(String(30), nullable=False, default="cloud")
+    dpa_status: Mapped[str] = mapped_column(String(20), nullable=False, default="none")
+    retention_policy: Mapped[str] = mapped_column(Text, nullable=False, default="")
+    training_on_customer_data: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    transfer_notice: Mapped[str] = mapped_column(Text, nullable=False, default="")
+    allowed_data_classes: Mapped[list] = mapped_column(JSONB, nullable=False, default=list)
+
 
 # --- Models ---
 

app/plugins/builtins/ai_assistant/schemas.py

@@ -18,6 +18,14 @@ class AIProviderCreate(BaseModel):
     is_active: bool = True
     is_default: bool = False
     config: dict[str, Any] = Field(default_factory=dict)
+    # Compliance metadata (B-AIPROV-COMP)
+    region: str = Field(default="unknown", max_length=20)
+    hosting_type: str = Field(default="cloud", max_length=30)
+    dpa_status: str = Field(default="none", max_length=20)
+    retention_policy: str = Field(default="")
+    training_on_customer_data: bool = False
+    transfer_notice: str = Field(default="")
+    allowed_data_classes: list[str] = Field(default_factory=list)
 
 
 class AIProviderUpdate(BaseModel):
@@ -28,6 +36,14 @@ class AIProviderUpdate(BaseModel):
     is_active: bool | None = None
     is_default: bool | None = None
     config: dict[str, Any] | None = None
+    # Compliance metadata (B-AIPROV-COMP)
+    region: str | None = Field(None, max_length=20)
+    hosting_type: str | None = Field(None, max_length=30)
+    dpa_status: str | None = Field(None, max_length=20)
+    retention_policy: str | None = None
+    training_on_customer_data: bool | None = None
+    transfer_notice: str | None = None
+    allowed_data_classes: list[str] | None = None
 
 
 class AIProviderResponse(BaseModel):
@@ -40,6 +56,14 @@ class AIProviderResponse(BaseModel):
     is_active: bool
     is_default: bool
     config: dict[str, Any]
+    # Compliance metadata (B-AIPROV-COMP)
+    region: str = "unknown"
+    hosting_type: str = "cloud"
+    dpa_status: str = "none"
+    retention_policy: str = ""
+    training_on_customer_data: bool = False
+    transfer_notice: str = ""
+    allowed_data_classes: list[str] = Field(default_factory=list)
     created_at: datetime | None = None
     updated_at: datetime | None = None
 

app/plugins/builtins/unified_search/embedding.py

@@ -147,6 +147,29 @@ async def index_entity(
             logger.debug("Empty embedding text for %s/%s", entity_type, entity_id)
             return False
 
+        # Apply sensitive-data filter: ensure no sensitive fields leak into
+        # embedding text.  The provider builds text from DB columns, so we
+        # rely on the provider selecting only non-sensitive columns.  This
+        # is a secondary safety net — providers should use filter_for_embeddings
+        # when constructing embedding text from dict-like data.
+        from app.core.sensitive_data import get_sensitive_fields
+
+        sensitive = get_sensitive_fields(entity_type)
+        if sensitive:
+            # If any sensitive field name appears as a substring in the text,
+            # it's likely a key=value pair — redact it.  This is a best-effort
+            # guard; providers are expected to exclude sensitive columns at
+            # the SQL level.
+            for field_name in sensitive:
+                # Only redact if the field name appears as a key-like pattern
+                import re
+                text = re.sub(
+                    rf"\b{re.escape(field_name)}\s*[=:]\s*\S+",
+                    f"{field_name}=***REDACTED***",
+                    text,
+                    flags=re.IGNORECASE,
+                )
+
         embedding = await generate_embedding(text, db=db, tenant_id=tenant_id)
         if not embedding:
             return False

app/routes/errors.py

@@ -31,7 +31,12 @@ _SENSITIVE_PATTERNS = re.compile(
 
 
 def _sanitize_context(context: Any, max_depth: int = 3, _depth: int = 0) -> Any:
-    """Recursively remove sensitive keys and limit depth/size of context data."""
+    """Recursively remove sensitive keys and limit depth/size of context data.
+
+    Combines regex-based pattern matching with the central
+    :mod:`app.core.sensitive_data` module to ensure entity-specific
+    sensitive fields are also redacted.
+    """
     if _depth > max_depth:
         return "[truncated]"
     if isinstance(context, dict):
@@ -49,6 +54,23 @@ def _sanitize_context(context: Any, max_depth: int = 3, _depth: int = 0) -> Any:
     return context
 
 
+def _sanitize_entity_context(context: dict[str, Any]) -> dict[str, Any]:
+    """Sanitize context dict using both pattern matching and entity-aware redaction.
+
+    If the context contains an ``entity_type`` key, uses :func:`sanitize_dict`
+    from :mod:`app.core.sensitive_data` to redact entity-specific sensitive
+    fields.  Falls back to pattern-based sanitization otherwise.
+    """
+    from app.core.sensitive_data import sanitize_dict
+
+    entity_type = context.get("entity_type") or context.get("type")
+    if entity_type:
+        sanitized = sanitize_dict(context, str(entity_type))
+    else:
+        sanitized = dict(context)
+    return _sanitize_context(sanitized)
+
+
 # -- Request schema --
 
 class ErrorReport(BaseModel):
@@ -77,7 +99,10 @@ async def report_error(error: ErrorReport, request: Request) -> Response:
         return Response(status_code=status.HTTP_429_TOO_MANY_REQUESTS)
 
     # Sanitize context to prevent leaking sensitive data
-    sanitized_context = _sanitize_context(error.context) if error.context else None
+    if error.context:
+        sanitized_context = _sanitize_entity_context(error.context)
+    else:
+        sanitized_context = None
 
     # Log with structured info
     logger.error(

app/services/export_service.py

@@ -10,6 +10,7 @@ from typing import Any
 from sqlalchemy import select, func
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.sensitive_data import get_sensitive_fields
 from app.models.contact import Contact
 
 
@@ -48,21 +49,30 @@ class ExportService:
         result = await db.execute(base)
         contacts = result.scalars().all()
 
-        output = io.StringIO()
-        writer = csv.writer(output)
-        writer.writerow([
+        # Exclude sensitive fields that must never appear in exports
+        sensitive = get_sensitive_fields("contact")
+
+        all_headers = [
             "id", "type", "displayname", "name", "firstname", "surname", "code",
             "email_1", "email_2", "phone_1", "phone_2", "website",
             "mailing_city", "mailing_postalcode", "mailing_country",
             "vat_code", "tags",
-        ])
+        ]
+        # Drop headers for sensitive fields (e.g. password_hash would never be
+        # in a contact row, but this is a safety net).
+        export_headers = [h for h in all_headers if h not in sensitive]
+
+        output = io.StringIO()
+        writer = csv.writer(output)
+        writer.writerow(export_headers)
         for c in contacts:
-            writer.writerow([
-                str(c.id), c.type, c.displayname, c.name or "", c.firstname or "", c.surname or "",
-                c.code or "", c.email_1 or "", c.email_2 or "", c.phone_1 or "", c.phone_2 or "",
-                c.website or "", c.mailing_city or "", c.mailing_postalcode or "",
-                c.mailing_country or "", c.vat_code or "", c.tags or "",
-            ])
+            row = []
+            for h in export_headers:
+                if h in sensitive:
+                    row.append("")
+                else:
+                    row.append(getattr(c, h, None) or "")
+            writer.writerow(row)
         return output.getvalue()