HarveyTriage
BankCo · In-House LegalSR 11-7 governed

DataSpring Analytics

P2Tier 2 · High

Vendor MSA + DPA · MSA_DataSpring_DPA_v2.pdf · submitted Yesterday

01
Context
DealCustomer-analytics platform — MSA with data-processing addendum· the transaction these parties are negotiating
Counterparty
DataSpring Analytics
Private analytics vendor · ~Private (~$120M revenue)
Counsel: Cooley LLP
sent Vendor MSA + DPA
Submitted to · BankCo
Marcus Lee
VP, Data & Analytics
Forwarded to Legal · Yesterday
escalated to Legal
Reviewer — you
Tong
Senior Counsel, Vendor & Commercial
Reviewing now
02
Where this stands
Enginecomplete · auto-routedYouNo review required
Privacy review SLA · 3 business daysin queue Yesterday
03
The decision
Routed to
Privacy Counsel

Privacy / Data Protection · P2

Auto-routedcleared gate · 96% ≥ 95%
Cleared the auto-route gate at 96% — routed to Privacy Counsel (Privacy / Data Protection). No review required.
04
Evidence

What the engine read

classification 96%

Vendor MSA + DPA — data analytics, customer PII processing

Extracted signalsclick any to trace to source

How material it is

Risk vectorroutes to specialist · curates context
  • Data / Privacy0.74
  • Regulatory0.48
  • Counterparty0.20
  • Strategic0.12
  • M&A0.03
Severityranks priority
0.52Tier 2 · High

Severity Tier 2 sets priority and SLA. Routing is decided by the Data / Privacy dimension (0.74) — the same severity with a different hot dimension routes to a different specialist. The vector routes, not the scalar.

Auto-clearedAuto-route gate · 90–100% band
target 95%
this case 96%
90%100%

This case sits 1 point above the 95% calibrated auto-route threshold — so it auto-cleared to its destination without human review.

Gate compares routing-decision confidence against system calibration (when the engine says 95%, observed accuracy must hold at 95%) — the SR 11-7 number.

Why this routing — policy basis

“Any vendor agreement under which the vendor processes BankCo customer personal data must be routed to Privacy Counsel, ahead of standard vendor review, regardless of contract value.”
Why it applies

Vendor processes customer PII under a DPA → Privacy Counsel per §4.3 and learned rule kb_3; confidence 0.96 ≥ 0.95 auto-routes.

Precedent applied

Vendor MSAs touching customer PII → Privacy Counsel ahead of standard vendor review

Institutional rule learned 2 weeks ago — the engine is routing with the bank's own accumulated judgment.

Proposed resolution — suggested redlines

2 proposed
  1. §DPA.4 — Sub-processors

    Require BankCo's prior written approval for new sub-processors

    BankCo's DPA standard requires approval rights; the draft permits notice-only addition of sub-processors.

  2. §DPA.7 — Breach notification

    Tighten breach-notification window 72 hours → 48 hours

    BankCo's standard for processors of customer PII is a 48-hour notification window.

05
Oversight
Audit trail
model-risk record · SR 11-7
5 events
  1. just nowTong · Senior Counsel, Vendor & CommercialCase opened for review
  2. YesterdayIntake systemDocument received from Marcus Lee (Data & Analytics)
  3. YesterdayExtraction engine v3.18 signals extracted, mean confidence 0.9696%
  4. YesterdayMateriality engine v1.4Risk vector + severity computed: 0.52 (Tier 2). Data dimension hot.
  5. YesterdayRouting engine v1.4Destination: Privacy Counsel (rule kb_3 matched). Auto-route gate: 0.96 ≥ 0.95 → AUTO-ROUTED96%