[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-\u002Fes\u002Fdocs\u002Fsecurite\u002Faudit-rgpd":3,"docs-nav-es":401},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"body":10,"_type":395,"_id":396,"_source":397,"_file":398,"_stem":399,"_extension":400},"\u002Fes\u002Fdocs\u002Fsecurite\u002Faudit-rgpd","securite",false,"","Auditoría RGPD y registro de accesos","Cómo betool rastrea los accesos cross-tenant al contenido de usuario y da soporte al derecho de acceso (artículo 15) y al derecho de supresión (artículo 17).",{"type":11,"children":12,"toc":385},"root",[13,21,28,33,112,131,137,156,165,170,175,181,194,207,213,235,258,268,274,286,292,304,309,315,334,380],{"type":14,"tag":15,"props":16,"children":17},"element","p",{},[18],{"type":19,"value":20},"text","betool está diseñado para cumplir los requisitos del RGPD sin apaños: cada acceso al contenido de un usuario por parte de un agente perteneciente a otra organización se registra, y cada organización puede consultar su propio registro.",{"type":14,"tag":22,"props":23,"children":25},"h2",{"id":24},"el-registro-de-accesos",[26],{"type":19,"value":27},"El registro de accesos",{"type":14,"tag":15,"props":29,"children":30},{},[31],{"type":19,"value":32},"Una tabla dedicada registra, para cada acceso cross-tenant:",{"type":14,"tag":34,"props":35,"children":36},"ul",{},[37,43,56,68,73,85,107],{"type":14,"tag":38,"props":39,"children":40},"li",{},[41],{"type":19,"value":42},"La marca de tiempo",{"type":14,"tag":38,"props":44,"children":45},{},[46,48,54],{"type":19,"value":47},"La organización de ",{"type":14,"tag":49,"props":50,"children":51},"strong",{},[52],{"type":19,"value":53},"destino",{"type":19,"value":55}," (cuyo contenido se leyó)",{"type":14,"tag":38,"props":57,"children":58},{},[59,61,66],{"type":19,"value":60},"La organización ",{"type":14,"tag":49,"props":62,"children":63},{},[64],{"type":19,"value":65},"lectora",{"type":19,"value":67}," (normalmente el proveedor)",{"type":14,"tag":38,"props":69,"children":70},{},[71],{"type":19,"value":72},"El usuario que desencadenó la lectura",{"type":14,"tag":38,"props":74,"children":75},{},[76,78,83],{"type":19,"value":77},"La ",{"type":14,"tag":49,"props":79,"children":80},{},[81],{"type":19,"value":82},"herramienta",{"type":19,"value":84}," a través de la cual se realizó la lectura",{"type":14,"tag":38,"props":86,"children":87},{},[88,90,97,99,105],{"type":19,"value":89},"El tipo de entidad (vocabulario cerrado: ",{"type":14,"tag":91,"props":92,"children":94},"code",{"className":93},[],[95],{"type":19,"value":96},"context",{"type":19,"value":98}," para una conversación, ",{"type":14,"tag":91,"props":100,"children":102},{"className":101},[],[103],{"type":19,"value":104},"scenario",{"type":19,"value":106}," para un benchmark)",{"type":14,"tag":38,"props":108,"children":109},{},[110],{"type":19,"value":111},"El ID de la entidad leída (y el exchange concreto cuando la lectura se refiere a un único turno)",{"type":14,"tag":15,"props":113,"children":114},{},[115,117,122,124,129],{"type":19,"value":116},"El vocabulario de entidades está ",{"type":14,"tag":49,"props":118,"children":119},{},[120],{"type":19,"value":121},"cerrado a nivel de base de datos",{"type":19,"value":123}," (restricción CHECK) y ",{"type":14,"tag":49,"props":125,"children":126},{},[127],{"type":19,"value":128},"cerrado a nivel de código",{"type":19,"value":130}," (lista blanca de la aplicación). Añadir un tipo = nueva migración + actualización de la lista blanca. Sin entradas sorpresa.",{"type":14,"tag":22,"props":132,"children":134},{"id":133},"derecho-de-acceso-artículo-15",[135],{"type":19,"value":136},"Derecho de acceso (artículo 15)",{"type":14,"tag":15,"props":138,"children":139},{},[140,142,147,149,154],{"type":19,"value":141},"Cada organización puede consultar SUS PROPIOS registros de acceso, en ",{"type":14,"tag":49,"props":143,"children":144},{},[145],{"type":19,"value":146},"Ajustes de la organización → Privacidad",{"type":19,"value":148}," (sección ",{"type":14,"tag":49,"props":150,"children":151},{},[152],{"type":19,"value":153},"Registro de accesos",{"type":19,"value":155},") o mediante:",{"type":14,"tag":157,"props":158,"children":160},"pre",{"code":159},"GET \u002Fapi\u002Fadmin\u002Fme\u002Fsupervisor-reads\n",[161],{"type":14,"tag":91,"props":162,"children":163},{"__ignoreMap":7},[164],{"type":19,"value":159},{"type":14,"tag":15,"props":166,"children":167},{},[168],{"type":19,"value":169},"La ruta devuelve las lecturas en orden cronológico descendente (hasta 1 000 entradas por llamada).",{"type":14,"tag":15,"props":171,"children":172},{},[173],{"type":19,"value":174},"Sin acceso cross-org al registro de auditoría: el proveedor nunca ve los registros de auditoría del cliente.",{"type":14,"tag":22,"props":176,"children":178},{"id":177},"derecho-de-supresión-artículo-17",[179],{"type":19,"value":180},"Derecho de supresión (artículo 17)",{"type":14,"tag":15,"props":182,"children":183},{},[184,186,192],{"type":19,"value":185},"La arquitectura permite ejecutar la supresión de forma limpia: todos los datos de una organización están vinculados a su ",{"type":14,"tag":91,"props":187,"children":189},{"className":188},[],[190],{"type":19,"value":191},"org_id",{"type":19,"value":193}," (tablas de negocio, carpetas de archivos, secretos), lo que permite una supresión específica — un usuario concreto, una conversación concreta o la organización entera — sin tocar el resto.",{"type":14,"tag":15,"props":195,"children":196},{},[197,199,205],{"type":19,"value":198},"Las solicitudes de supresión (artículo 17) se tramitan con nuestro soporte: escribe a ",{"type":14,"tag":91,"props":200,"children":202},{"className":201},[],[203],{"type":19,"value":204},"contact@betool.fr",{"type":19,"value":206}," desde una cuenta de administrador de la organización correspondiente.",{"type":14,"tag":22,"props":208,"children":210},{"id":209},"opt-in-y-opt-out-de-lectura-cross-tenant",[211],{"type":19,"value":212},"Opt-in y opt-out de lectura cross-tenant",{"type":14,"tag":15,"props":214,"children":215},{},[216,218,227,229,233],{"type":19,"value":217},"Por defecto, el opt-in de lectura cross-tenant está fijado en ",{"type":14,"tag":49,"props":219,"children":220},{},[221],{"type":14,"tag":91,"props":222,"children":224},{"className":223},[],[225],{"type":19,"value":226},"FALSE",{"type":19,"value":228},". Un administrador de la organización puede activarlo — y revocarlo en cualquier momento — en ",{"type":14,"tag":49,"props":230,"children":231},{},[232],{"type":19,"value":146},{"type":19,"value":234},".",{"type":14,"tag":34,"props":236,"children":237},{},[238,248],{"type":14,"tag":38,"props":239,"children":240},{},[241,246],{"type":14,"tag":49,"props":242,"children":243},{},[244],{"type":19,"value":245},"Desactivado",{"type":19,"value":247}," — por defecto. El proveedor no puede acceder a ningún contenido de esta organización. Consecuencia: no es posible ningún soporte cross-org sobre lo que afecta al contenido (el soporte estructural sigue siendo posible).",{"type":14,"tag":38,"props":249,"children":250},{},[251,256],{"type":14,"tag":49,"props":252,"children":253},{},[254],{"type":19,"value":255},"Activado",{"type":19,"value":257}," — el supervisor puede leer las conversaciones de la organización para diagnosticar, y cada acceso queda auditado y es consultable por la organización.",{"type":14,"tag":15,"props":259,"children":260},{},[261,266],{"type":14,"tag":49,"props":262,"children":263},{},[264],{"type":19,"value":265},"El proveedor NO PUEDE activar este opt-in en nombre del cliente.",{"type":19,"value":267}," Esta es una prueba fundamental: si el proveedor puede activarlo sin una acción del cliente, la arquitectura está rota.",{"type":14,"tag":22,"props":269,"children":271},{"id":270},"salvaguarda-de-operaciones-destructivas",[272],{"type":19,"value":273},"Salvaguarda de operaciones destructivas",{"type":14,"tag":15,"props":275,"children":276},{},[277,279,284],{"type":19,"value":278},"Cualquier operación que destruya o reemplace contenido (DELETE, REPLACE-IN-PLACE) se ",{"type":14,"tag":49,"props":280,"children":281},{},[282],{"type":19,"value":283},"rechaza en el validador",{"type":19,"value":285}," si la organización de destino no ha activado el opt-in de lectura. Motivo: sin visibilidad, el operador estaría proponiendo a ciegas un payload que sobrescribiría el contenido existente.",{"type":14,"tag":22,"props":287,"children":289},{"id":288},"denegación-en-cascada-si-la-auditoría-no-está-disponible",[290],{"type":19,"value":291},"Denegación en cascada si la auditoría no está disponible",{"type":14,"tag":15,"props":293,"children":294},{},[295,297,302],{"type":19,"value":296},"Si la base de datos de auditoría no está disponible (incidente de infraestructura), todas las lecturas cross-tenant se ",{"type":14,"tag":49,"props":298,"children":299},{},[300],{"type":19,"value":301},"rechazan",{"type":19,"value":303},". Política estricta: sin lectura sin rastro.",{"type":14,"tag":15,"props":305,"children":306},{},[307],{"type":19,"value":308},"Consecuencia del lado del código: un llamador que capture una excepción debe volver a lanzar el error de auditoría antes de cualquier procesamiento de negocio. Es un invariante verificado por el benchmark de seguridad.",{"type":14,"tag":22,"props":310,"children":312},{"id":311},"cookies-de-consentimiento",[313],{"type":19,"value":314},"Cookies de consentimiento",{"type":14,"tag":15,"props":316,"children":317},{},[318,320,325,327,332],{"type":19,"value":319},"El sitio de marketing (betool.ai) mide su audiencia con ",{"type":14,"tag":49,"props":321,"children":322},{},[323],{"type":19,"value":324},"Google Analytics 4",{"type":19,"value":326},", en ",{"type":14,"tag":49,"props":328,"children":329},{},[330],{"type":19,"value":331},"Consent Mode v2",{"type":19,"value":333},":",{"type":14,"tag":34,"props":335,"children":336},{},[337,356,368],{"type":14,"tag":38,"props":338,"children":339},{},[340,342,347,349,354],{"type":19,"value":341},"Por defecto, todos los consentimientos de Google (medición, publicidad) están en ",{"type":14,"tag":49,"props":343,"children":344},{},[345],{"type":19,"value":346},"rechazado",{"type":19,"value":348},": el script de Google Analytics ",{"type":14,"tag":49,"props":350,"children":351},{},[352],{"type":19,"value":353},"no se carga",{"type":19,"value":355}," y no se deposita ninguna cookie analítica.",{"type":14,"tag":38,"props":357,"children":358},{},[359,361,366],{"type":19,"value":360},"El script solo se carga, y la medición solo se activa, ",{"type":14,"tag":49,"props":362,"children":363},{},[364],{"type":19,"value":365},"tras tu aceptación explícita",{"type":19,"value":367}," de la medición de audiencia en el banner.",{"type":14,"tag":38,"props":369,"children":370},{},[371,373,378],{"type":19,"value":372},"Puedes retirar este consentimiento en cualquier momento (",{"type":14,"tag":49,"props":374,"children":375},{},[376],{"type":19,"value":377},"Gestionar las cookies",{"type":19,"value":379},", en el pie de página): la medición vuelve entonces a rechazado.",{"type":14,"tag":15,"props":381,"children":382},{},[383],{"type":19,"value":384},"Los consentimientos publicitarios siguen rechazados: el sitio no realiza segmentación publicitaria.",{"title":7,"searchDepth":386,"depth":386,"links":387},2,[388,389,390,391,392,393,394],{"id":24,"depth":386,"text":27},{"id":133,"depth":386,"text":136},{"id":177,"depth":386,"text":180},{"id":209,"depth":386,"text":212},{"id":270,"depth":386,"text":273},{"id":288,"depth":386,"text":291},{"id":311,"depth":386,"text":314},"markdown","content:es:docs:5.securite:3.audit-rgpd.md","content","es\u002Fdocs\u002F5.securite\u002F3.audit-rgpd.md","es\u002Fdocs\u002F5.securite\u002F3.audit-rgpd","md",[402],{"title":403,"_path":404,"children":405},"Es","\u002Fes",[406],{"title":407,"_path":408,"children":409},"Docs","\u002Fes\u002Fdocs",[410,423,451,479,492,506,519,580],{"title":411,"_path":412,"children":413},"Primeros pasos","\u002Fes\u002Fdocs\u002Fdemarrer",[414,417,420],{"title":415,"_path":416},"Bienvenido","\u002Fes\u002Fdocs\u002Fdemarrer\u002Fbienvenue",{"title":418,"_path":419},"Crear una cuenta","\u002Fes\u002Fdocs\u002Fdemarrer\u002Fcreer-un-compte",{"title":421,"_path":422},"Conectar una clave LLM","\u002Fes\u002Fdocs\u002Fdemarrer\u002Fbrancher-llm",{"title":424,"_path":425,"children":426},"Canales","\u002Fes\u002Fdocs\u002Fcanaux",[427,430,433,436,439,442,445,448],{"title":428,"_path":429},"Visión general de los canales","\u002Fes\u002Fdocs\u002Fcanaux\u002Fvue-densemble",{"title":431,"_path":432},"Telefonía en tiempo real","\u002Fes\u002Fdocs\u002Fcanaux\u002Ftelephone",{"title":434,"_path":435},"Email","\u002Fes\u002Fdocs\u002Fcanaux\u002Femail",{"title":437,"_path":438},"Widget de chat web","\u002Fes\u002Fdocs\u002Fcanaux\u002Fchat-widget",{"title":440,"_path":441},"Webhook HTTP","\u002Fes\u002Fdocs\u002Fcanaux\u002Fwebhook",{"title":443,"_path":444},"Mensajería (WhatsApp, Messenger, Telegram, Mattermost)","\u002Fes\u002Fdocs\u002Fcanaux\u002Fmessageries",{"title":446,"_path":447},"Meta Lead Ads","\u002Fes\u002Fdocs\u002Fcanaux\u002Ffacebook-leads",{"title":449,"_path":450},"Schedule (cron)","\u002Fes\u002Fdocs\u002Fcanaux\u002Fschedule",{"title":452,"_path":453,"children":454},"Pipelines","\u002Fes\u002Fdocs\u002Fpipelines",[455,458,461,464,467,470,473,476],{"title":456,"_path":457},"El editor visual","\u002Fes\u002Fdocs\u002Fpipelines\u002Fediteur-visuel",{"title":459,"_path":460},"Agentes IA","\u002Fes\u002Fdocs\u002Fpipelines\u002Fagents",{"title":462,"_path":463},"Operadores deterministas","\u002Fes\u002Fdocs\u002Fpipelines\u002Foperateurs",{"title":465,"_path":466},"Control de flujo","\u002Fes\u002Fdocs\u002Fpipelines\u002Fcontrole-flux",{"title":468,"_path":469},"Code Steps","\u002Fes\u002Fdocs\u002Fpipelines\u002Fcode-step",{"title":471,"_path":472},"Sub-pipelines","\u002Fes\u002Fdocs\u002Fpipelines\u002Fsous-pipelines",{"title":474,"_path":475},"Acciones no-code","\u002Fes\u002Fdocs\u002Fpipelines\u002Factions-no-code",{"title":477,"_path":478},"Base de conocimiento","\u002Fes\u002Fdocs\u002Fpipelines\u002Fbase-de-connaissances",{"title":480,"_path":481,"children":482},"Supervisión","\u002Fes\u002Fdocs\u002Fsupervision",[483,486,489],{"title":484,"_path":485},"Historial de ejecuciones","\u002Fes\u002Fdocs\u002Fsupervision\u002Fexecutions",{"title":487,"_path":488},"Créditos y medición","\u002Fes\u002Fdocs\u002Fsupervision\u002Fcredits-metering",{"title":490,"_path":491},"Benchmarks","\u002Fes\u002Fdocs\u002Fsupervision\u002Fbenchmarks",{"title":493,"_path":494,"children":495},"Seguridad","\u002Fes\u002Fdocs\u002Fsecurite",[496,499,502,503],{"title":497,"_path":498},"Principios de seguridad","\u002Fes\u002Fdocs\u002Fsecurite\u002Fprincipes",{"title":500,"_path":501},"Multi-tenancy estricto","\u002Fes\u002Fdocs\u002Fsecurite\u002Fmulti-tenant",{"title":8,"_path":4},{"title":504,"_path":505},"Despliegue soberano","\u002Fes\u002Fdocs\u002Fsecurite\u002Fdeploiement-souverain",{"title":507,"_path":508,"children":509},"Desarrolladores","\u002Fes\u002Fdocs\u002Fdeveloppeurs",[510,513,516],{"title":511,"_path":512},"API de administración","\u002Fes\u002Fdocs\u002Fdeveloppeurs\u002Fapi-admin",{"title":514,"_path":515},"Webhooks salientes","\u002Fes\u002Fdocs\u002Fdeveloppeurs\u002Fwebhooks-sortants",{"title":517,"_path":518},"Pilota betool desde Claude (MCP)","\u002Fes\u002Fdocs\u002Fdeveloppeurs\u002Fmcp",{"title":520,"_path":521,"children":522},"Integraciones","\u002Fes\u002Fdocs\u002Fintegrations",[523,526,529,532,535,538,541,544,547,550,553,556,559,562,565,568,571,574,577],{"title":524,"_path":525},"Visión general de las integraciones","\u002Fes\u002Fdocs\u002Fintegrations\u002Fvue-densemble",{"title":527,"_path":528},"Stripe","\u002Fes\u002Fdocs\u002Fintegrations\u002Fstripe",{"title":530,"_path":531},"GitHub","\u002Fes\u002Fdocs\u002Fintegrations\u002Fgithub",{"title":533,"_path":534},"Google","\u002Fes\u002Fdocs\u002Fintegrations\u002Fgoogle",{"title":536,"_path":537},"LinkedIn Ads","\u002Fes\u002Fdocs\u002Fintegrations\u002Flinkedin-ads",{"title":539,"_path":540},"Kavkom","\u002Fes\u002Fdocs\u002Fintegrations\u002Fkavkom",{"title":542,"_path":543},"Jira","\u002Fes\u002Fdocs\u002Fintegrations\u002Fjira",{"title":545,"_path":546},"Slack","\u002Fes\u002Fdocs\u002Fintegrations\u002Fslack",{"title":548,"_path":549},"SMS","\u002Fes\u002Fdocs\u002Fintegrations\u002Fsms",{"title":551,"_path":552},"Enable Banking (open banking)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fenable-banking",{"title":554,"_path":555},"CRM, marketing y productividad","\u002Fes\u002Fdocs\u002Fintegrations\u002Fcrm-marketing",{"title":557,"_path":558},"HeyGen (vídeo)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fheygen",{"title":560,"_path":561},"La Poste","\u002Fes\u002Fdocs\u002Fintegrations\u002Fla-poste",{"title":563,"_path":564},"CRM de negocio (beTool Application, Qhare)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fcrm-metier",{"title":566,"_path":567},"Mitti (inspecciones de campo)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fmitti",{"title":569,"_path":570},"Meta (Messenger, Páginas, Meta Ads)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fmeta",{"title":572,"_path":573},"Onoff Business (Beta)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fonoff",{"title":575,"_path":576},"Smart Life \u002F Tuya (objetos conectados)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fsmart-life",{"title":578,"_path":579},"Productos beTool (Desktop, Kiosk, Terminal)","\u002Fes\u002Fdocs\u002Fintegrations\u002Fproduits-betool",{"title":581,"_path":582,"children":583},"Casos de uso","\u002Fes\u002Fdocs\u002Fcas-usage",[584,587,590,593,596,599],{"title":585,"_path":586},"Agentes de negocio tipo","\u002Fes\u002Fdocs\u002Fcas-usage\u002Fvue-densemble",{"title":588,"_path":589},"CFO IA","\u002Fes\u002Fdocs\u002Fcas-usage\u002Fcfo-ia",{"title":591,"_path":592},"COO IA","\u002Fes\u002Fdocs\u002Fcas-usage\u002Fcoo-ia",{"title":594,"_path":595},"CTO IA","\u002Fes\u002Fdocs\u002Fcas-usage\u002Fcto-ia",{"title":597,"_path":598},"Product Manager IA","\u002Fes\u002Fdocs\u002Fcas-usage\u002Fproduct-manager-ia",{"title":600,"_path":601},"Asistente personal","\u002Fes\u002Fdocs\u002Fcas-usage\u002Fassistant-personnel"]