# Compliance (/api-v2/compliance)



The compliance surface backs the published legal pages and the console privacy controls with a single source of truth: a machine-readable sub-processor list and per-project privacy preferences. Defaults are privacy-protective. See [GDPR and CCPA](/security/gdpr-ccpa).

All requests require a bearer API key. See [authentication](/api-reference/authentication).

## List sub-processors [#list-sub-processors]

`GET /v2/compliance/sub-processors`

Returns the canonical sub-processor list. It mirrors the published legal page, so any integration reads the same authoritative set.

```bash
curl https://api.zumik.ai/v2/compliance/sub-processors \
  -H "Authorization: Bearer $ZUMIK_API_KEY"
```

```json
{
  "object": "list",
  "published_at": "2026-06-12",
  "data": [
    {
      "name": "Stripe",
      "purpose": "Billing, subscriptions, and payment processing",
      "data_categories": ["account", "billing", "payment_metadata"],
      "region": "us"
    },
    {
      "name": "Cloudflare",
      "purpose": "Edge TLS, WAF, DDoS protection, and CDN for all properties",
      "data_categories": ["request_metadata", "ip_address"],
      "region": "global_edge"
    }
  ]
}
```

<ResponseField name="object" type="string">
  Always `list`.
</ResponseField>

<ResponseField name="published_at" type="string">
  The list's last review date.
</ResponseField>

<ResponseField name="data" type="array">
  Each sub-processor with its `name`, `purpose`, `data_categories`, and `region`.
</ResponseField>

## Read privacy preferences [#read-privacy-preferences]

`GET /v2/compliance/privacy-preferences`

Returns the project's privacy preferences, falling back to the protective defaults when none are set.

```bash
curl https://api.zumik.ai/v2/compliance/privacy-preferences \
  -H "Authorization: Bearer $ZUMIK_API_KEY"
```

```json
{
  "object": "privacy_preferences",
  "project_id": "prj_01jy7n0a4c8m2t6v9q3wrxk7bd",
  "do_not_sell": true,
  "gpc_honored": true,
  "analytics_consent": false,
  "updated_at": "2026-06-15T16:42:30Z"
}
```

<ResponseField name="object" type="string">
  Always `privacy_preferences`.
</ResponseField>

<ResponseField name="project_id" type="string">
  The owning project.
</ResponseField>

<ResponseField name="do_not_sell" type="boolean">
  Always `true`. Zumik does not sell personal information regardless.
</ResponseField>

<ResponseField name="gpc_honored" type="boolean">
  Always `true`. Global Privacy Control signals are honored at the edge.
</ResponseField>

<ResponseField name="analytics_consent" type="boolean">
  Opt-in consent for non-essential analytics. Defaults to `false`.
</ResponseField>

<ResponseField name="updated_at" type="string">
  RFC 3339 update timestamp.
</ResponseField>

## Update privacy preferences [#update-privacy-preferences]

`POST /v2/compliance/privacy-preferences`

Updates the analytics-consent choice. The change is recorded in the audit log. `do_not_sell` is always honored and cannot be toggled off.

<ParamField body="analytics_consent" type="boolean">
  `true` to opt into non-essential analytics, `false` to opt out. Defaults to `false`.
</ParamField>

```bash
curl https://api.zumik.ai/v2/compliance/privacy-preferences \
  -H "Authorization: Bearer $ZUMIK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "analytics_consent": true }'
```

Returns the updated preferences object.

## Errors [#errors]

| Status | Code              | When                        |
| ------ | ----------------- | --------------------------- |
| 401    | `invalid_api_key` | Missing or invalid API key. |

See the full table on [errors](/api-reference/errors).