Found while integrating cadeom (api.cadeom.unlikeotherai.com) against UOA, working from the integration guide at /llm. Each item below was verified against the UOA source, not inferred from behaviour.
Not a documentation issue — a capability gap that blocks a consuming product.
UOA provides deactivate, reactivate and soft-remove (tombstone) for members. There is no erase operation.
cadeom currently satisfies GDPR erasure requests by anonymising the person in its own tables (rewriting email and display name). Once UOA becomes the source of truth for identity — which is the direction we are going — cadeom can no longer honour an erasure request on its own, because the authoritative copy of the person's name and email lives in UOA and there is no way to erase it.
That makes this a blocker for retiring local credentials, not just a nice-to-have.
Ask: is an erase/anonymise operation planned? If the intended answer is that tombstoning is sufficient for GDPR, it would help to state that position explicitly in the docs, along with what data is retained after a soft-remove and for how long, so consuming products can point at it in their own compliance evidence.
Found while integrating cadeom (
api.cadeom.unlikeotherai.com) against UOA, working from the integration guide at/llm. Each item below was verified against the UOA source, not inferred from behaviour.Not a documentation issue — a capability gap that blocks a consuming product.
UOA provides
deactivate,reactivateand soft-remove (tombstone) for members. There is no erase operation.cadeom currently satisfies GDPR erasure requests by anonymising the person in its own tables (rewriting email and display name). Once UOA becomes the source of truth for identity — which is the direction we are going — cadeom can no longer honour an erasure request on its own, because the authoritative copy of the person's name and email lives in UOA and there is no way to erase it.
That makes this a blocker for retiring local credentials, not just a nice-to-have.
Ask: is an erase/anonymise operation planned? If the intended answer is that tombstoning is sufficient for GDPR, it would help to state that position explicitly in the docs, along with what data is retained after a soft-remove and for how long, so consuming products can point at it in their own compliance evidence.