Soma1. Purpose and status / Zweck und Status
This is the control schedule for Annex B of the DPA / AVV. It identifies measures to specify, implement and evidence for the deployment. It does not assert that each measure operates everywhere. Before processing, record implementation, owner, evidence, review date and any alternative for each applicable control.
Diese Anlage benennt zu konkretisierende Maßnahmen. Vor Verarbeitungsbeginn sind tatsächliche Umsetzung, Verantwortliche, Nachweise, Prüfdatum und gegebenenfalls gleichwertige Alternativen für die jeweilige Bereitstellung festzuhalten.
2. Access and confidentiality / Zutritt und Zugriff
- Identify infrastructure operators and physical security evidence for hosting and backups.
- Document identity lifecycle, least privilege, administrative MFA, service accounts, sessions and prompt revocation.
- Test tenant and role boundaries across records, search, files, APIs, MCP, exports and AI retrieval.
- Restrict support to authorised purposes, named personnel, confidentiality and reviewable access records.
3. Transmission and storage / Weitergabe und Speicherung
- Record TLS and encryption at rest for databases, files, logs and backups; identify key ownership, rotation and recovery.
- Keep credentials and tokens out of source code and ordinary records; define secret handling.
- Document approved regions, remote administration, transfer safeguards and supplier authorisations.
- Use appropriate minimisation, pseudonymisation and redaction, including in support and AI logs.
4. Integrity and accountability / Integrität und Nachweis
- Define audit events, evidence access, retention, tamper protection and clock synchronisation.
- Document secure changes, dependency updates, vulnerability handling, testing and production separation.
- Specify connector scopes, agent permissions and approvals for sending, deleting, publishing or committing changes.
- Record incident response, notifications, rights assistance and escalation owners.
5. Availability and resilience / Verfügbarkeit
- Record monitoring, alerts, staffing and response coverage.
- Specify backup frequency, encryption, isolation, retention and final deletion; test and document restoration.
- Agree RPO/RTO and continuity responsibilities rather than inferring them from a hosting product.
6. Evaluation and deletion / Prüfung und Löschung
Define periodic effectiveness reviews and review after change or incident. Set retention by data category and verify deletion across primary storage, files, indexes, embeddings, caches, connectors and backups. Use the exit schedule. A public overview or supplier certificate cannot replace deployment evidence or an Article 32 risk assessment.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub