Where databases are hosted in cloud or with third-party infrastructure providers, the database owner remains accountable under PPL and DSR. Personal data at rest should be encrypted, key management documented, and the cloud provider treated as an outsourced holder under regulation 15. Cross-border hosting must also satisfy the Transfer Regulations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.