Version 1.0-draft
Draft for review. These terms are not yet offered for acceptance, and marked fields are still to be completed.
Version 1.0-draft
Completion required before acceptance. The following are completion requirements, not verified certifications.
To complete: the security schedule this Annex incorporates (docs/legal/security-schedule-v1.md, owner instructions item 4.1), with its title, version, date and sections filled into the provision below
The technical and organisational measures applicable to Customer Applicant Data are those in To complete: security schedule title, version and date, sections To complete: specified sections, supplied to the Customer with this DPA and incorporated into it. Those sections distinguish implemented measures from any future work; future work is not evidence of an implemented safeguard. The Processor shall maintain protection no less effective than the incorporated measures throughout processing. If there is a conflict, this DPA prevails.
To complete: compliance register title/version and security-audit record identifiers support the incorporated measures but do not amend this DPA or restrict its audit rights. The Processor shall make relevant evidence available under the DPA, subject to proportionate confidentiality and security safeguards. Subsequent changes shall be versioned and communicated to the Customer; no change may materially reduce protection or retrospectively alter the accepted commitments. Changes requiring revised instructions or authorisation must be agreed before the affected processing begins.
| Control area | Detail to document and test |
|---|---|
| Tenant isolation | Workspace scoping for files, database records, search, export, APIs and administrative routes; negative cross-tenant access tests |
| Access control | Client permissions, privileged access, authentication safeguards, staff access restrictions, approval and access logs |
| Encryption | Actual transport and at-rest protections, key and secret management, supplier scope |
| Application security | Secure development, vulnerability handling, patching, testing and incident escalation |
| Availability and recovery | Backup scope, recovery testing, resilience and restoration arrangements |
| Logs and monitoring | Logged events, access limits, redaction, identifiable content, log retention and incident detection |
| AI | Enabled routes, approved models, input minimisation, supplier retention and training restrictions, accuracy/bias review and human-review controls |
| Return | Tested export contents, format, delivery, authorisation and availability during the full 30-day window |
| Deletion | Prefix and database deletion; derived outputs, caches and supplier propagation; failures, retries and evidence |
| Backups | Maximum erasure cycle To complete: backup-erasure maximum; isolation, no ordinary reuse, access restrictions and reapplication of deletion after restore |
| Retention clock | Enumerated qualifying last-activity events To complete: qualifying last-activity events; 14-day warning; interaction with termination and earlier erasure |