Good, Risky, and Diff in one place.

This page is the evaluation workspace. It clarifies each scenario and provides direct links to working PDF and Markdown artifacts.

Good

Low-risk vendor case

Control evidence is complete, and no blocking contractual issues are detected.

Risky

Key clauses and controls are weak, so remediation and explicit approval are required.

Diff

Only what changed from v1 to v2 is shown so reviewers focus on real deltas.

Use this to understand a clean, approval-ready packet with strong controls and complete evidence.

Overall risk level

Low

No material findings. Contract and controls look strong for this scope.

Deletes within 30 days
Evidence: dpa.md Section 5 Retention & Deletion
Provides 30-day notice before adding subprocessors
Evidence: dpa.md Section 6 Subprocessors
Incident notice in 72 hours
Evidence: incident_response.md Notifications
Logs retained 90 days
Evidence: security_policy.md Logging
Customer consent required for subcontractors
Evidence: msa_excerpt.md Subcontracting

Each file below is synthetic Mode0 data and can be shared internally for evaluation.