Skip to main content
CMDashCybersecurity Maturity Dashboard
DocsAdministrationLegal — Data Processing Addendum

Legal — Data Processing Addendum

Purpose: read and accept the CMDash Data Processing Addendum (DPA) on behalf of your organization, with a real, timestamped acceptance record.

Accepting the DPA — /settings/legal

The DPA is published as prose on the public trust page (/trust/dpa). /settings/legal adds a record of who at your organization agreed to it:

  • The current version, a Download PDF link, and a link to the full text on the trust page are shown to every member.
  • An owner sees a checkbox ("I am authorised to bind <your org>") and an Accept the DPA button. Accepting is once per version: a second attempt at the same version is refused (409) rather than silently recorded twice.
  • Everyone else (admin, member, viewer) sees the current acceptance status and, if nobody has accepted yet, a note to ask an owner.
  • On acceptance, CMDash stores the version, the accepting user, the request IP, and the user agent, and emails the accepting user a link to the executed PDF immediately.

If the DPA is ever updated, it ships as a new version. A previous version's acceptance never counts for the new one — the page will ask again, and the prior acceptance stays on record for its own version.

This page is the product manual, published from the repository at docs/user/admin/legal.md. Customers read the same text inside CMDash under Help. Last updated October 9, 2026.

Legal — Data Processing Addendum — CMDash Docs