Compliance
Customer-facing compliance duties that code runs: the subprocessor list and its...
Install
npx skills add kortix-ai/suna --skill compliance -g -a claude-code -y- Repository
- kortix-ai/suna20.3k
- Category
- Testing
- Updated
- 3d ago
- License
- See repository
- Context cost
- Mediumabout 2,112 tokens
- Runs scripts
- No, instructions only
What it does
Customer-facing compliance duties that code runs: the subprocessor list and its automatic 30-day DPA notice, Terms of Service changes, customer logo use (publicity), and the audit evidence it leaves. Load WHENEVER you add, remove or change a subprocessor (a new model provider, host, email or analytics vendor), route customer data to a new third party, touch apps/web/.../legal/subprocessors, packages/shared/src/subprocessors.ts or apps/api/src/billing/services/subprocessor-notices.ts, the Terms of Service text or packages/shared/src/terms.ts, or need proof for an auditor that customers were notified. Load too for staff access to a customer account: act-as impersonation, 'Open as admin', and its audit trail; and for a penetration test report: the status of each finding and the risks Kortix accepts.
Compliance
The Data Processing Addendum (DPA) promises two things that code keeps:
- Section 7.2 / Annex III:
/legal/subprocessorslists every third party that processes customer personal data. - Section 7.3: a new subprocessor gets at least 30 days' notice before it processes customer personal data.
Add a subprocessor
A new vendor that sees customer data is a subprocessor: a model provider for Kortix-managed models, a host, an email, log or analytics vendor. A model a customer reaches with their own key is not one.
- Sign or accept the vendor's DPA. For an inference vendor, confirm zero data retention for our account.
- Add the row to
packages/shared/src/subprocessors.ts. Use the vendor's legal entity name from its terms. SetaddedOnto the day the PR merges. MoveSUBPROCESSORS_UPDATEDto the same day. - Merge to
dev. The row ships with the next prod release. - Send the vendor no customer data before the row's effective date
(
addedOn+ 37 days). The page shows it as "From <date>". Managed-model inference is served by Platinum Inference: give the Platinum team the same date, and Platinum Inference holds the change back until then.
A change to an existing row (purpose, location) needs no addedOn and sends
no email. Removing a vendor needs no notice: delete the row.
What runs by itself
runSubprocessorNoticeSweep (apps/api/src/billing/services/subprocessor-notices.ts)
runs hourly in the billing worker, on prod only (INTERNAL_KORTIX_ENV=prod).
