The subscriber makes the movement, security and privacy of its data transparent by keeping a data classification and handling scheme that defines data types by sensitivity and residency policy, drawn from its own classification policy or an applicable standard scheme, and by assessing whether the provider can protect data while it moves and while it is stored using recognised encryption and cryptographic practice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.