Processing roles
For customer telemetry, the customer is the controller and COHESION is the processor. COHESION acts on documented instructions to score oversight telemetry against the specification.
Data processed
Judgment Independence Score telemetry for an assessment window: escalation events, review timestamps, reviewer roles, override actions, request metadata, and pseudonymous operator identifiers supplied by the customer. Telemetry is reduced to dimension scores; raw payload handling depends on the contracted deployment and customer configuration.
No model training
COHESION does not use customer telemetry, customer payloads, evidence receipts, API traffic, or support content to train foundation models or general-purpose AI systems. Any customer-specific analysis is used only to provide, secure, support, and evidence the COHESION service.
Data subject rights
COHESION assists the controller in responding to data subject requests, including access, rectification, and erasure, under a 30 day manual service level. Because telemetry is pseudonymous and reduced to dimension scores, most requests resolve at the controller's source system.
Retention
Dimension scores and evidence receipts are retained for the period set in the order. Customers can request deletion subject to legal retention obligations. On termination, COHESION returns or deletes processed data at the controller's election, subject to those obligations.
Security and breach notification
COHESION maintains the technical and organizational measures described on the Security Posture page. In the event of a personal data breach, COHESION notifies the controller without undue delay and within 72 hours of becoming aware, with the information the controller needs to meet its own notification duties.
International transfers
Hosted processing occurs in the contracted region where available. Where cross-border transfer terms are required, the executable DPA may include the EU Standard Contractual Clauses or another transfer mechanism appropriate to the customer and deployment. Self hosted deployments can reduce COHESION-hosted processing but may still use separately contracted support or communications systems.
Audit rights
The controller may verify COHESION's compliance with this agreement through the tamper-evident audit chain and the documentation made available during procurement. Where a DPIA is required, COHESION provides the information reasonably necessary to support it.
Subprocessors
The public subprocessor list is published and dated on the Subprocessors page. Customer-specific notice and objection rights are handled in the executable DPA or order form.
Requesting the agreement
To request an executable DPA, contact peyton@cohesionauth.com with the subject line DPA request, your entity name, jurisdiction, and the regulatory framework driving the requirement.