Last updated: 2026-07-02 · Version: draft-1
Variables
- Roles: customer is controller; Cruma is processor for workspace content.
- Subprocessors: docs/legal/subprocessors.md, updated before any new subprocessor touches customer data.
- Security measures: tenant isolation with fail-closed policy checks, credential-free model context, append-only audit ledgers, approval-gated consequential actions, RLS at the database boundary.
- Retention: run-record bodies inline 30 days then archived; deletion on verified request; cancellation does not auto-delete.
- Training: no customer content used for model training absent explicit opt-in (Privacy Policy); enforcement is technical (fail-closed export gate), not procedural.