Compliance console reference
This page describes the fields, states, and values shown in the MapleGather compliance console, at /admin/admin-security/compliance. (The Admin & Security sidebar link has no page of its own yet, so open the console by that address.)
DPA signing states
Section titled “DPA signing states”| State | Meaning | Available actions |
|---|---|---|
| Unsigned | Your organization has not signed the current DPA version — either it never signed, or MapleGather has published a new version since the last signature. | Sign DPA (with signing authority) |
| Signed | Your organization signed the current version. The tab shows “Signed on {date}”. | None — no signed copy is produced to download |
The tab shows the current version number and its publication date. It does not show the agreement’s text or offer it as a download. Signatures for earlier versions are listed under Prior versions with the version and signing date.
Signing records the signatory’s name and title, the version and the time. No confirmation email is sent and no signed (executed) PDF is produced — Signed on the DPA tab is the record.
The Sign DPA action is hidden for board members (read-only role). All other tabs are visible to board members.
Sub-processor table columns
Section titled “Sub-processor table columns”| Column | What it shows |
|---|---|
| Name | The third-party service provider. |
| Purpose | What the sub-processor does (for example: email delivery, payment processing). |
| Location | The processing location recorded for this sub-processor in the signed-in list (— when none is recorded). Once published, consult the public sub-processor document for the approved processing-region statement. |
The table has no status column, no activation or removal dates and no change history, and MapleGather sends no email when the list changes.
Breach SLA (P-level classification)
Section titled “Breach SLA (P-level classification)”The Breach SLA tab lists incidents only. Each incident shows a severity badge — Critical (P0), High (P1), Medium (P2) or Low (P3) — with its status (Investigating, Mitigated, Resolved or Post-mortem published), the date it occurred and the date it was resolved (or Ongoing). The tab does not show the notification timelines below. No incidents recorded means the list loaded and is empty; when the list fails to load, the tab shows Could not load incident history with Try again (a page reload). The timelines are MapleGather’s notification policy per level, recorded here for reference:
| Level | Severity | Customer notification SLA |
|---|---|---|
| P0 | Confirmed breach | Initial notice to affected organizations within 24 hours of confirmation; follow-up with scope, timeline, and remediation within 72 hours. |
| P1 | Suspected breach / active investigation, widespread outage, or payment-data-handling failure | Initial notice within 72 hours if customer action may be required; follow-up within 7 days if investigation closes without a confirmed breach. |
| P2 | Incident affecting one organization or a vulnerability requiring customer action | Notice to affected organizations within 5 business days; broader status page only if a pattern indicates risk across organizations. |
| P3 | Routine advisory / low-severity vulnerability | Quarterly security-advisory digest, or status page as needed. |
SOC 2 posture
Section titled “SOC 2 posture”The Compliance page has no SOC 2 tab yet. MapleGather is not SOC 2 certified, and the console shows no certification status or Attestation of Compliance.
Data residency
Section titled “Data residency”The public sub-processor document will carry the approved processing-region statement once it is published. Until then, there is no approved statement to share. The signed-in list’s provider regions do not establish a blanket data-residency guarantee.
Permissions required
Section titled “Permissions required”| Action | Required scope |
|---|---|
| View DPA | compliance:view |
| Sign or re-sign the DPA | compliance:sign_dpa |
| View sub-processor list | compliance:view_sub_processors |