Articles 39, 52 and 70 with Decree Article 64: a controller that has data processed on its behalf chooses a processor offering sufficient guarantees; controller and processor both ensure the Article 71 security measures; the processing is governed by a written contract binding the processor to act only on the controller's instructions and stating its security and confidentiality obligations; anyone acting under the controller or processor processes data only on the controller's instructions; the controller remains responsible for the processor's use and disclosure of the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.