Processing on a controller's behalf must be governed by a binding contract setting out instructions, the nature and purpose of processing, data types, duration, and both parties' rights and obligations, and requiring the processor to impose confidentiality on each person processing the data, delete or return all data at the end of services unless law requires retention, provide information demonstrating compliance on reasonable request, and allow and cooperate with reasonable assessments by the controller or its assessor, or arrange an independent assessment against an accepted control framework and share the report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.