Trust centre • Draft
Subprocessors
A reviewable register is required before production publication.
Proposed scope for formal review
A production version should state the applicable scope, accountable owner, effective date, review cadence and approved commitments in precise language.
It should distinguish implemented technical controls from organizational procedures, customer responsibilities, third-party dependencies and future ambitions. Evidence links should only be published after operational verification.
Review questions
- Which legal entity, product, environment and users are in scope?
- Which controls or commitments are implemented and independently evidenced?
- What choices, responsibilities and contact paths must customers understand?
- What retention, incident, change and governance processes require approval?