Ship LGPD compliance in a sprint. Prove it on every deadline.

LGPD gives you hard deadlines on deletion requests and expects a defensible record of every consent and every erasure. Most teams bolt this on with a few database columns and good intentions — exactly what falls apart under an ANPD inquiry or acquisition diligence, because a column can be edited after the fact and nobody can tell. Zelo turns "we think we handled it" into a chain you can recompute and hand over: who consented, what was deleted, and that it happened before the clock ran out. When someone asks "prove it," you run one curl instead of digging through logs.

Add one dependency, set your API key and webhook secret, and consent + deletion-request compliance becomes method calls on an injected ZeloClient. Declare a purpose once at boot. Gate any feature on live consent — and isGranted returns false for a never-seen user, so it never throws. Record a decision with grantConsent; open an erasure with requestDeletion. No DTOs to hand-write, no schema to design. The same thing is a one-line REST call:

# Record a consent decision — one REST call
curl -X POST https://api.zelocompliance.com/v1/consents \
  -H "Authorization: $ZELO_API_KEY" \
  -d '{"external_id":"u_123","purpose_key":"marketing-emails","action":"GRANT","source":"signup-form"}'

// Gate any feature on live consent — false for a never-seen user, never throws
if (zelo.isGranted("u_123", "marketing-emails")) { sendNewsletter(user); }

// Handle a deletion request — Zelo signs the webhook, you run the erasure
@ZeloWebhook("dsr.delete.requested")
public Map<String,Object> erase(ZeloDeletionRequest req) {
    users.deleteByExternalId(req.externalId());   // your DB, your erasure
    return Map.of("deletedRows", 1);          // proof goes back to Zelo
}

# Recompute the entire hash chain and prove it unbroken
GET https://api.zelocompliance.com/v1/audit/verify

→ {"ok":true,"entries_checked":N}

// In the Spring starter — a green check for your admin dashboard
boolean intact = zelo.verifyAudit().ok();

Zelo is a control plane, not a data store. It only ever sees an opaque external_id — your own user id — plus consent records, request state, and the audit trail. Names, emails, CPF, dates of birth, health data: all of it stays in your database, where it already lives. Most compliance tools become a second copy of everything sensitive you own — a honeypot waiting to leak. Zelo orchestrates operations on your data via signed webhooks instead, so there's nothing inside it worth stealing. Adopting compliance tooling shouldn't make you a bigger target; by design, it doesn't.

Open a request and Zelo computes the legal deadline and fires an HMAC-SHA256-signed webhook to your app. Annotate one method and your own erasure runs:

@ZeloWebhook("dsr.delete.requested")
public Map<String,Object> erase(ZeloDeletionRequest req) {
    users.deleteByExternalId(req.externalId());  // your DB, your erasure
    return Map.of("deletedRows", 1);             // proof goes back to Zelo
}

The starter verifies the signature and freshness, calls you, and auto-fulfills the request with your return value as the audited proof. Throw from the handler and Zelo treats the erasure as failed and retries with backoff; an OVERDUE sweep flags anything past its deadline as an audited SLA miss — so a missed request surfaces as an alert, not a finding. The whole loop runs end to end out of the box; the demo erases a user and self-fulfills in about a second.

Every compliance event is appended to a per-integrator, hash-chained log. The rule is published and reproducible:

entry_hash = SHA-256(
  prev_hash       // 64 zeros for the genesis entry
  + "\n" + event_type
  + "\n" + canonical_json(payload)
  + "\n" + occurred_at
)

GET /v1/audit/verify recomputes the entire chain and points straight at the first broken link, so tampering with, deleting, or reordering any historical entry is detected — and because the algorithm is pure and published, your proof trail can be independently re-implemented and re-verified. You never have to take our word for the math.

{"ok":true,"entries_checked":N} is the closest thing to unforgeable evidence that your compliance work was real and on time. The v1 code is easy to clone; a multi-year, untampered proof trail is not. In the starter it's one call: zelo.verifyAudit().ok() — a green check for your admin dashboard.

Apache-2.0 and self-hostable from day one: docker compose up brings up the control plane, a demo integrator, and Postgres, and runs the full deletion loop end to end. Built on Java 21, Spring Boot 3, and PostgreSQL.

• Append-only, explicit JDBC — no ORM. The consent ledger and audit log enforce that discipline at the data layer.
• Transactional outbox. An event is queued in the same commit as the request it belongs to, then signed and delivered with HMAC-SHA256.
• Idempotent & rate-limited writes via Idempotency-Key.
• Ten LGPD Art. 7 legal bases as a typed enum — CONSENT, CONTRACT, LEGAL_OBLIGATION, HEALTH_PROTECTION, LEGITIMATE_INTEREST, and the rest.
• No vendor lock-in, no PII leaving your perimeter, no sales call to start.

Read every line on GitHub before you trust it with a single request: github.com/thgrcarvalho/zelo.

The code is Apache-2.0 either way — hosting is what you pay for, and only past a real free tier.

Prices in BRL, billed monthly via card, cancel anytime. Cancelling drops you to the free tier — your data and audit chain stay intact.