Sign the DPA and review your compliance posture

This guide walks you through signing the Data Processing Agreement (DPA) and reviewing MapleGather’s compliance information — including sub-processors, breach notification timelines, and incident history.

Who can do this: Org owners and admins authorized to sign legal documents can sign the DPA. Admins and board members can review the Compliance tabs their permissions allow; signing requires separate authority.

Before you start

You must have authority to sign legal agreements on behalf of your organization. The signing screen asks you to confirm this before you can complete the process.

Steps

Check the DPA status and current agreement

Open the Compliance page at /admin/admin-security/compliance. (The Admin & Security link in the sidebar has no page of its own yet, so it can’t take you there.)
On the Compliance page, select the DPA tab.
Check the DPA status: Signed or Unsigned. Unsigned also appears when MapleGather has published a new DPA version since your last signature.
Check the version number and its publication date shown under Data Processing Agreement.
Note that the console does not show the agreement’s text or offer it as a download.

If the current version is already signed

Stop the signing steps; there is nothing to sign again. The DPA tab shows Signed and “Signed on {date}” — that is the record. No signed (executed) copy is produced to download. Continue with the sub-processor and breach review below.

If signing or re-signing is needed

Select Sign DPA (shown when the status is Unsigned and you have signing authority).
On Step 1, enter or confirm your name under Full name.
Enter or confirm your title under Title / Role.
Select Next.
On Step 2, review the summary of your name and title. Select Back if either needs changing.
Read the authorization statement: “I am authorized to sign legal agreements on behalf of this organization and agree to the Data Processing Agreement terms.”
Select the acknowledgment checkbox.
Check that Sign DPA is now enabled — it stays disabled until the checkbox is selected.
Select Sign DPA. If the DPA signed successfully. message appears, continue at Step 11.
If Step 2 instead shows “You don’t have permission to do that.”, nothing was signed. You do have signing access: MapleGather accepts a DPA signature only within five minutes of your last sign-in, and this message means your sign-in is older than that. The form keeps your name, title and acknowledgment, but signing again from it gives the same message. Note down your name and title, sign out, sign back in, return to this page and work through Step 1 and Step 2 again within five minutes, then select Sign DPA. There is no in-page prompt to confirm your identity in this version.
Wait for the DPA signed successfully. message. It names who the signature is recorded for and says that no confirmation email is sent and no signed PDF is produced. This confirms the signing; a later page-load problem does not undo it.
Select Return to Compliance.
Check that the DPA tab shows Signed and “Signed on {date}”. There is no signed copy to download, and no email arrives.

If Step 2 shows “Signature not recorded — your form is preserved, please try again.”, the outcome is not confirmed; follow DPA signing result could not be confirmed.

Review sub-processors

On the Compliance page, select the Sub-processors tab.
Review the table showing each sub-processor’s Name, Purpose and Location.

The table has no status column, no activation or removal dates and no change history. If the list is empty, it shows No sub-processors. Use Retry only when the list fails to load; if it fails again, reload the page to try again. Neither state proves that no providers exist.

Review breach SLA and incident history

On the Compliance page, select the Breach SLA tab.
Review the incident history list. Each incident shows its title and summary, a severity badge (Critical, High, Medium or Low), its status (Investigating, Mitigated, Resolved or Post-mortem published), the date it occurred and either the date it was resolved or Ongoing, and a View post-mortem link when one is published. The tab does not show MapleGather’s notification timelines.
No incidents recorded appears only when the list loaded and is empty. When the list fails to load, the tab shows Could not load incident history (“The incident list request failed, so this page can’t show whether any incidents are recorded.”) with Try again, which reloads the page.

Review SOC 2 posture

The Compliance page has no SOC 2 tab yet, so there is no SOC 2 posture to review in the product. MapleGather is not SOC 2 certified.

View the public compliance page

When the counsel-approved public sub-processor document is published, open its link from the MapleGather marketing site. It leads to /legal/subprocessors without a product sign-in. Until publication, there is no approved statement to share.
Share that published processing-region statement when available. The signed-in table shows individual provider regions; it does not establish a blanket data-residency guarantee.

Verify

The DPA signed successfully. message confirms a new signing. On the DPA tab, Signed and “Signed on {date}” confirm the current version, including one that was already signed when you arrived. No email is sent and no signed PDF is produced. If the return to Compliance fails, do not sign again merely because that later read failed; retry the page.

If something goes wrong

“Signature not recorded — your form is preserved, please try again.” — A timeout or server error stopped the screen from getting a result, so the signature may or may not have been recorded; the screen does not check. Open the DPA tab at /admin/admin-security/compliance?tab=dpa. If it shows Signed, you’re done. If it does not, sign again — a version already signed is refused with DPA already signed, so you cannot sign twice. See DPA signing result could not be confirmed.
There’s no executed copy to download, and no confirmation email arrived — MapleGather records the signature but produces no signed PDF and sends no email. If the DPA tab shows Signed, the signature is confirmed. Do not sign a second time to get a copy.
“You don’t have permission to do that.” after selecting Sign DPA — If the Sign DPA button was shown to you, you have signing access. The message means your last sign-in is more than five minutes old, which MapleGather does not accept for a DPA signature. Nothing was signed. Sign out, sign back in and sign within five minutes (Step 10 above). The form does not keep what you typed across the sign-in, so note your name and title first.
Sign DPA button is not visible — Board members can view the compliance console but cannot sign the DPA. Only org owners and authorized admins see the Sign DPA button. Contact your org owner if you need signing access.