Data Flow with PII Boundary

{
  "nodes": [
    { "id":"u","type":"ellipse","label":"User","x":40,"y":160,"fill":"#dcfce7" },
    { "id":"web","type":"rect","label":"Web app","x":220,"y":160,"fill":"#dbeafe" },
    { "id":"api","type":"rect","label":"API\n(TLS)","x":420,"y":160,"fill":"#dbeafe" },
    { "id":"db","type":"rect","label":"Postgres\n(at-rest enc)","x":620,"y":60,"fill":"#fef3c7" },
    { "id":"warehouse","type":"rect","label":"Warehouse\n(pseudonymised)","x":620,"y":260,"fill":"#ede9fe" },
    { "id":"bi","type":"rect","label":"BI tool","x":820,"y":260,"fill":"#ede9fe" },
    { "id":"pii","type":"note","label":"PII boundary — only API + DB hold raw PII","x":420,"y":40,"fill":"#fef9c3" }
  ],
  "edges": [
    { "id":"e1","source":"u","target":"web","label":"HTTPS" },
    { "id":"e2","source":"web","target":"api","label":"mTLS" },
    { "id":"e3","source":"api","target":"db" },
    { "id":"e4","source":"db","target":"warehouse","label":"hash + tokenise","style":"dashed" },
    { "id":"e5","source":"warehouse","target":"bi" }
  ]
}