Data Processing Agreement
Last updated: 1 May 2026 · Privacy · Subprocessors · Security
1. Roles
The Customer is the "Controller" of personal data processed through the Service. CME is the "Processor" and acts only on documented instructions from the Controller. Subprocessors engaged by CME process under terms equivalent to those imposed on CME.
2. Subject matter + duration
Processing is for the purpose of operating the CME Service — ingesting AWS metadata via STS:AssumeRole, processing customer documents to extract claims, running the agent loop, persisting findings, and supporting customer success. Duration is the subscription term + 30 days for deletion.
3. Categories of data + data subjects
Categories of data: account-administration data (employee work email, role, IP), AWS configuration metadata (account ids, ARNs, tags, but never object content), and document text uploaded by the Customer. Data subjects: Customer's employees and authorized end users.
4. Security
CME implements the technical + organizational measures described at /security (encryption in transit + at rest, RLS tenancy isolation, MFA- gated SSO, vulnerability management, annual third-party pentest, breach notification within 72 hours).
5. Subprocessors
The current list of subprocessors is at /subprocessors. We notify Customer 30 days before adding a new subprocessor; Customer may object in writing within 14 days. If we cannot accommodate the objection, Customer may terminate the affected Service component for a pro-rata refund.
6. International transfers
CME is US-headquartered. Transfers from the EEA, UK, and Switzerland are governed by the EU Standard Contractual Clauses (Modules 2 and 3, dated 4 June 2021) and the UK International Data Transfer Addendum, both of which are incorporated by reference into this DPA. Enterprise customers may pin storage to EU regions (eu-west-1 / eu-central-1) for full data residency.
7. Data subject requests
CME assists the Controller with data subject requests via the in-product data portal and the export / delete API endpoints. Verified deletion is completed within 30 days.
8. Audit rights
Once CME has issued a third-party security attestation (SOC 2 Type I/II, ISO 27001, or pen-test report), Customer may request a copy under NDA no more than once per year. As of the date of this DPA, no such attestation has been issued — see /security for the current roadmap. On-site audits are available with written notice for Enterprise customers.
9. Breach notification
We notify Controller in writing within 72 hours of confirming a personal data breach affecting the Controller's data, including: nature + categories of data + records affected; likely consequences; measures taken or proposed to mitigate; and the contact for further information.
10. Deletion + return
On termination, CME provides Customer 30 days to export data via the data portal. After 30 days, all Customer Data is deleted from active systems and from backups within the following 90 days.
11. Liability
The liability cap in the master Terms applies to this DPA. Where law requires unlimited liability for personal data breaches, the cap shall apply only to the maximum extent permitted by that law.
Appendix A — Technical + organizational measures
See /security.
Appendix B — Subprocessors
See /subprocessors.