Subprocessor change notice
First Six commits to 30 days' notice of subprocessor changes to institutions.
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
GDPR (EU General Data Protection Regulation)PrivacyApplicable law
Applies via international students. The 72-hour breach path is in the incident runbook, Article 28 processor terms sit in the counsel-approved DPA, Article 17 erasure maps to the student's own hard-delete cascade (with the audit-trail carve-out disclosed rather than hidden), and Article 22-equivalent disclosure covers automated crisis detection.
- Art. 28Processor obligations
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.