From 6dfc564be6a2bcef2ef400da86122955fbc556b7 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Tue, 21 Jul 2026 17:25:36 +0200 Subject: [PATCH] fix(web): align privacy and terms with the DPA-owns-the-register split Privacy: "Sub-processors and Outbound Data Flows" becomes "External Services". It still names who receives data, which is a controller's own duty, but drops the Art. 28 vocabulary and the promise to announce new sub-processors - that commitment lives in the data processing agreement. Points at the renamed docs page and notes the DPA is available on request. Terms: the MSP clause now says a managing organization is responsible for having the necessary data protection agreements with its customers, instead of classifying it as a processor or sub-processor. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../app/privacy/page.tsx | 21 ++++++++++--------- .../autopilot-monitor-web/app/terms/page.tsx | 4 ++-- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/src/Web/autopilot-monitor-web/app/privacy/page.tsx b/src/Web/autopilot-monitor-web/app/privacy/page.tsx index 263c687d..62cececa 100644 --- a/src/Web/autopilot-monitor-web/app/privacy/page.tsx +++ b/src/Web/autopilot-monitor-web/app/privacy/page.tsx @@ -2,7 +2,7 @@ import { PublicPageHeader } from "../../components/PublicPageHeader"; const LAST_UPDATED = "21 July 2026"; const DOCS_SECURITY_FAQ = "https://docs.autopilotmonitor.com/trust/security-faq"; -const DOCS_SUBPROCESSORS = "https://docs.autopilotmonitor.com/trust/subprocessors"; +const DOCS_DATA_FLOWS = "https://docs.autopilotmonitor.com/trust/data-flows"; function DocsLink({ href, children }: { href: string; children: React.ReactNode }) { return ( @@ -119,19 +119,20 @@ export default function PrivacyPage() { isolation model is in the Security & Privacy FAQ.

-

Sub-processors and Outbound Data Flows

+

External Services

- Microsoft Azure is the only sub-processor that stores your data. Resend is used solely to - deliver the onboarding approval email when a tenant is activated — it receives an administrator's email - address and the tenant domain, never enrollment telemetry. Vulnerability reference data is pulled inbound from - NVD, the CISA KEV catalog, and MSRC; no customer data is sent to them. + Microsoft Azure is the only place your data is stored. Resend delivers the onboarding + approval email when a tenant is activated — it receives an administrator's email address and the tenant + domain, never enrollment telemetry. Vulnerability reference data is read inbound from NVD, the CISA KEV + catalog, and MSRC; nothing about your environment is sent to them.

- Some data flows exist only because you configure them: your own Azure storage account for diagnostics, + Further connections exist only because you configure them: your own Azure storage account for diagnostics, notification channels such as Teams, Slack, or a generic webhook, and your own AI assistant if a user connects - one through the MCP integration. The platform itself makes no calls to any AI or LLM provider. The complete - list is published as Sub-processors, and new sub-processors are - announced there before they are introduced. + one through the MCP integration. The platform itself makes no calls to any AI or LLM provider.{" "} + Data Flows & External Services maps every outbound connection + and what it carries. The data processing agreement, available on request, is the authoritative document for + the parties engaged and the terms of their engagement.

Diagnostics Uploads

diff --git a/src/Web/autopilot-monitor-web/app/terms/page.tsx b/src/Web/autopilot-monitor-web/app/terms/page.tsx index dd2fbb42..b4db39af 100644 --- a/src/Web/autopilot-monitor-web/app/terms/page.tsx +++ b/src/Web/autopilot-monitor-web/app/terms/page.tsx @@ -85,7 +85,7 @@ export default function TermsPage() {
  • Delegated access is read-only and limited to exactly the tenants in scope. Configuration secrets are redacted.
  • A grant is either assigned by platform operators or delegated by the customer's own tenant admin; customer-initiated delegations require approval before they take effect.
  • Every grant, revocation, and disablement is recorded in the managed customer tenant's audit log, so a customer can always determine who holds access to their data.
    • -
  • A managing organization acts as a processor or sub-processor of its customers and is responsible for having the necessary agreements in place with them.
    • +
  • A managing organization is responsible for having the necessary data protection agreements in place with the customers it manages.
  • Access can be revoked at any time by the customer or by platform operators and takes effect within seconds.
    • @@ -127,7 +127,7 @@ export default function TermsPage() {

    Security and Transparency

    - The security architecture, data residency, sub-processors, retention and deletion behaviour, and an explicit + The security architecture, data residency, external services, retention and deletion behaviour, and an explicit statement of what the service does not do are published in the{" "} Security & Privacy FAQ. A signed data processing agreement is part of the Enterprise plan.