Compliance contracts

This directory holds references to signed compliance contracts — not the contracts themselves. Executed contracts live with counsel + the org’s legal-document store, not in source control. What lives here:

• One markdown file per contract recording: counterparty, scope, signed date, expiry / renewal date, and the storage location of the executed PDF.
• Notification triggers (sub-processor changes, breaches, etc.) link back to these files so engineering can confirm a contract is actually in place before relying on it.

Ledger

File	Counterparty	Scope	Signed	Expiry / renewal
anthropic-zdr.md	Anthropic, PBC	Zero Data Retention addendum on Enterprise tier — input bytes not retained beyond inference; the default 30-day abuse-monitoring window does not apply	2026-05-09	Annual auto-renew with parent Enterprise agreement

Adding a new entry

1. Counsel signs the contract with the counterparty.
2. PDF goes to the legal-document store (per the org’s records-retention policy, NOT this repo).
3. Add a markdown stub in this directory referencing the storage location, signed date, and scope.
4. Add a row to the ledger above.
5. Update any compliance docs that reference the contract (DPA template §6 Sub-processors, DPIA §1.5, ADR-0043 §"Sub-processors", etc.).
6. If the contract changes the residual risk in an active DPIA, update that DPIA’s risk register inline.