Skip to content

docs(security): DPA is not available; sub-processor list is published - #5967

Merged
vivekchand merged 4 commits into
mainfrom
docs/security-md-dpa-subprocessors-815
Sep 15, 2026
Merged

docs(security): DPA is not available; sub-processor list is published#5967
vivekchand merged 4 commits into
mainfrom
docs/security-md-dpa-subprocessors-815

Conversation

@vivekchand

@vivekchand vivekchand commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Refs vivekchand/clawmetry-landing#815

Requirement: https://factory.8090.ai/project/b415065f-ab2f-4f53-8864-0c009fd098cb/requirements/6f0ecab6-cdbd-4e47-a5ea-8765b22deee4 (Public Assurance Status, Sub-processor List and DPA Availability).

Merge order: satisfied. Landing PR https://github.com/vivekchand/clawmetry-landing/pull/828 (merged 2026-09-14) publishes /compliance, /subprocessors and /dpa, which this change links.

Why

The Compliance status table said "DPA / sub-processor list: Available on request; not yet published". The private supplier pack recorded that no DPA had been drafted or reviewed, so a DPA was never available on request. The sub-processor list is now published on clawmetry.com.

The same table said "SSO / SAML / SCIM: Not implemented", while the published /subprocessors page names WorkOS as the SAML and OIDC sign-in broker. The two public documents disagreed.

Change

Docs only: SECURITY.md.

  • "Sub-processor list: Available (link)" and "DPA: In progress, a draft exists but has not been reviewed by counsel, nothing to sign yet (link)". A first DPA draft was written after this PR was opened (private, clawmetry-cloud#2445); /compliance and /dpa change to match in the landing follow-up.
  • "SSO (SAML / OIDC): In progress, managed cloud only, brokered by WorkOS; not yet verified against a live identity provider; customer-hosted has no SSO" and "SCIM: Not implemented". This matches the internal enterprise-readiness checklist (identity-provider sign-in: PARTIAL, no live connection exercised) and does not claim SSO is available.
  • One sentence now points to the public compliance status page.

No code, no routes, no tests affected.

Not changed (noted for a follow-up)

  • "single-tenant, air-gapped supported" conflicts with the landing claims inventory, which does not claim a verified air-gapped dashboard.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jm9d7s4fN55hN3YzQo75o9

@vivekchand

vivekchand commented Sep 14, 2026

Copy link
Copy Markdown
Owner Author

Landing PR to merge first: https://github.com/vivekchand/clawmetry-landing/pull/828 publishes /compliance, /subprocessors and /dpa, which this SECURITY.md change links.

https://claude.ai/code/session_01Jm9d7s4fN55hN3YzQo75o9

@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

2 similar comments
@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

@vivekchand vivekchand mentioned this pull request Sep 14, 2026
Merged
@vivekchand @claude
docs(security): DPA is not available; sub-processor list is published
072bb28 
SECURITY.md said "DPA / sub-processor list: Available on request; not yet
published". No DPA has been drafted, so offering one on request was wrong,
and the sub-processor list is now public on clawmetry.com. Split the row and
link the compliance status page.

The same table said "SSO / SAML / SCIM: Not implemented" while the published
sub-processor list names WorkOS for SAML and OIDC sign-in. Split that row too:
SSO is in progress on the managed cloud only, not yet verified against a live
identity provider; SCIM is not implemented.

Refs vivekchand/clawmetry-landing#815

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jm9d7s4fN55hN3YzQo75o9
@vivekchand
vivekchand force-pushed the docs/security-md-dpa-subprocessors-815 branch from e757feb to 072bb28 Compare September 14, 2026 13:12
@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

@vivekchand Claude

vivekchand commented Sep 14, 2026

Copy link
Copy Markdown
Owner Author

Updated to current main via update_pull_request_branch (was behind by ~15 commits).

Generated by Claude Code

@vivekchand @claude
docs(security): DPA is in progress, drafted but not reviewed
1a8dde9 
A first draft now exists (private); nothing is available to sign until
counsel review, matching clawmetry.com/dpa.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PpgUzn1U4r61abUJN4PXn4
@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

@8090-software-factory

8090-software-factory Bot commented Sep 14, 2026

Copy link
Copy Markdown

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

@vivekchand
vivekchand merged commit 14da717 into main Sep 15, 2026
41 checks passed
vivekchand added a commit that referenced this pull request Sep 15, 2026
@vivekchand @claude
Carry #5957 and #5967 in batch 3
0097bbe 
Both merged onto main after 0.12.879 and before this release branch was
cut, so the release already contains their code. #5957 gets its CHANGELOG
entry; #5967 is documentation only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jm9d7s4fN55hN3YzQo75o9
@vivekchand vivekchand mentioned this pull request Sep 15, 2026
Open
vivekchand added a commit that referenced this pull request Sep 15, 2026
@vivekchand @claude
[RELEASE] Enterprise readiness batch 3: fleet install, LiteLLM gatewa…
ffb6afd 
…y, cold-load fix, hosted Cost Optimizer data

Carries #5950 (clawmetry service install/status/uninstall, per-user collectors on shared hosts), #5965 (LiteLLM gateway spend by team/person/key), #5957 (cold-load timeouts), #5996 (Cost Optimizer evidence slice), #5967 (CHANGELOG entries).

This triggers PyPI 0.12.880. After it publishes: verify wheel contains clawmetry service and gateway_litellm; wait for cloud auto-pin PR; landing #836 can drop its DO NOT MERGE prefix; cloud #2450 and #2455 can merge after the pin.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jgaf95Zzshc3FUBzqNRxiT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vivekchand