Internal — staff only
Keepable admin console
Operating surface for the Keepable team — verification disputes, CSAR fulfillment, audit-log inspection with Merkle-proof verification, sealed-document re-verification, and the workflows the DPO uses to discharge NDPA obligations.
Bespoke, not Retool — per ADR 0023 § 1 (data residency + Merkle UI + CSAR-as-product + per-seat economics).
NDPA-resident — hosted on ECS Fargate in af-south-1; no cross-border data plane in the render path.
Five additive role tiers — support / ops / dpo / engineer / admin per ADR 0024 § 3.
Four-eyes on destructive actions — enforced at the BFF, never at the UI, per ADR 0024 § 4.
v0 preview · console wiring lands progressively across Phase 2. All staff actions audit-logged to the same Merkle tree as user events.