Everything your reviewer asks for, in one place.

Subprocessors

These providers may process personal data on Compass’s instruction under a data processing agreement. Each is engaged for the stated purpose only.

EU transfer arrangements

Transfers of personal data outside the European Economic Area rely on EU Standard Contractual Clauses or an adequacy decision, as recorded per provider below.

No Article 27 representative in the European Union has been appointed; European enquiries are answered directly by the contact below.

Data subject requests are answered within 30 days. Use the data rights request form.

Retention

Retention is enforced nightly by an automated job. When a window closes, identifying fields are irreversibly redacted or the record is deleted. Client engagement records follow the engagement agreement.

Security controls

The control register as it stands. “Being formalised” means the control operates but the written procedure and evidence schedule are still being documented — it is stated rather than implied. Full detail sits in the IT Security Policy.

Incident response

Access to client material is restricted by role and logged. If a breach affecting personal data occurs, Compass notifies the relevant supervisory authority within 72 hours of becoming aware, notifies the client system owner within the same window, and informs affected people without undue delay where the risk to them is high.

Report a suspected vulnerability, exposure or misdirected record to skopecky@compassperformanceinc.com. Include what you observed and when; do not include the affected personal data in the message.

Terminology

The names used across this site and in the governing documents, in the order they sit: Compass Performance → Compass Enterprise Architecture™ → CompassOS™. Select a term for its definition.

• Compass PerformanceThe firm+
• Compass Enterprise Architecture™The methodology+
• CompassOS™The technology layer+
• The core architectureInside the architecture+
• The renewal engineInside the architecture+
• Enterprise execution disciplinesInside the architecture+

Terminology changes

When a governed name changes, the change is recorded here with the date it was published. Entries are added, never rewritten.

1. 29 August 2026 — Terminology glossary and change record published.

   • The three-level hierarchy — firm, methodology, technology layer — is now stated in one glossary rather than explained page by page.
   • The Security & Trust page carries the glossary, so an IT or legal reviewer can map the names used in the governing documents in one place.
   • Future naming changes are recorded on this list with the date they went live.

2. 19 August 2026 — Naming hierarchy normalized across the public site.

   • Compass Enterprise Architecture™ is the methodology name on every public surface, spelled from one register.
   • CompassOS™ is named only as the AI-enabled technology layer beneath the work — never as a service, a nav item or a headline.
   • The eight components keep the three governed groupings: the Core Architecture, the Renewal Engine, and Enterprise Execution Disciplines.
   • The earlier operating-system spelling of the methodology was retired to avoid collision with an unrelated third-party framework.

Contact

Security questions, IT review requests, subprocessor queries and incident reports go to one address.

• Email skopecky@compassperformanceinc.com
• Telephone 224.307.0912
• 500 West Silver Spring Drive, Suite K-200, Glendale, Wisconsin 53217, United States

This document is Compass's standard operating position, not legal advice. Compass is not your counsel. Have your own legal and IT functions review it before execution, and where an executed master agreement exists, that agreement controls.