Type: Risk acceptance
Subject: R-04
Decision requested: Accept the residual risk recorded for R-04 - Egress and vendor-side retention of regulated data
Inherent / residual: High / High
Control owner: Legal / Procurement (agreement) + InfoSec (retention settings)
Context: Treatment: Transfer - another function must deliver. What we can commit to: We can set retention and confirm the setting that excludes this data from model training. What remains: The contractual protection is not ours to deliver. Until an agreement covering regulated data is executed, retention settings do not address the underlying exposure, and deletion still depends on individual users deleting their own chats. Basis for acceptance: Yes if the connectors are used before an agreement is executed.
Open verification: V-26 [Moderate] Chat and project retention settings, and whether they are aligned to the records schedule.
Ruling:
Amendment or condition: