ME-TA is a Danish data processor under GDPR and Danish law. This page describes where your data goes, who sees it, and what is retained where — under which contractual instrument.
TL;DR. A sponsor uploads data through metawebservice.com directly into customer-scoped storage in AWS eu-west-1 (Ireland) under the AWS GDPR Data Processing Addendum. ME-TA operators on company-owned, BitLocker-encrypted PCs run a WinForms client that executes a three-stage workflow locally on the PC — work/ (human-actor), sce/ (machine-only deterministic SAS / R compute on the PC, no AI), and ai/ (Claude Code on the PC, with files staying local; only the AI prompt and completion travel out to AWS Bedrock in eu-central-1, Frankfurt for inference — curated operational content only; never patient or sample data). The entire client-work data chain is intra-EEA — no GDPR Chapter V transfer occurs. The engaged sub-processor is AWS EMEA SARL (Luxembourg) for storage and AI inference; Anthropic is the upstream model author and is not engaged as a separate sub-processor on the Bedrock path.
A sponsor's data follows a deterministic path from upload through ME-TA's three-stage architecture and back to the sponsor as deliverables. Every box and arrow below is under contractual coverage of the AWS GDPR DPA or ME-TA's own QMS controls.
End-to-end data flow. The three inter-stage control gates (human-gated promotion, SAS-file submission, automated redaction) are described in the narrative bullets below — this diagram answers "where does data physically go?" only.
meta-cli sync with S3 for sponsor exchange.Each transition between stages inside the WinForms client is controlled — by humans, by structural design, or by an automated filter. None of these controls is shown on the diagram above (which answers only "where does data go?"); they are stated here in prose:
Each row below is an actor in or around the data flow. Each column is a class of data. A cell shows the maximum visibility under normal operations; least-privilege controls in our QMS reduce actual visibility further per engagement role.
* ME-TA admin / DPO visibility into clinical content is gated by customer-admin authorisation per P07 §7.10 and P21 §21.8. ME-TA personnel do not readily have access to customer content unless the customer has granted access.
What is kept, where it is kept, how long, and under which contractual instrument.
Client-work retention only. ME-TA's internal-only use of consumer-tier Anthropic (no client content) is described in a separate note below.
Separate from anything on the diagram above: ME-TA uses consumer-tier Anthropic (e.g. Claude Max) for internal work only — platform development, internal documentation, learning. No client content ever travels this path, per P22 §22.3.4. Conversations on this path live on Anthropic infrastructure in the United States under Anthropic's Consumer Terms (indefinite until operator-deleted, +30 day backend grace, T&S exception up to 2 years for inputs/outputs and 7 years for classification scores). Anthropic on this path is not a sub-processor of ME-TA — it is ME-TA's own tool vendor for internal-only purposes, with no controller-processor relationship arising.
Sections 1–3 above answer the procurement / DPO questions: where data goes, who sees it, how long it's kept. This section is for the IT-security review: nine specific boundaries the architecture is designed to maintain, the layered controls behind each, and what specifically enforces them. Read it if you are mapping our controls to a security framework (ISO 27001 Annex A, SOC 2 CC, NIST SP 800-53) or running a vendor risk assessment.
Rows 1–7 are derived from context/operations/data-flow.md §7 (trust boundaries + enforcement). Rows 8–9 (prompt-injection mitigation; audit log tamper-evidence) are AI-specific and audit-integrity additions per the IT-security review.
ME-TA's contractual sub-processor chain for client work.
| Sub-processor | Role | Location | Instrument |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) — infrastructure | S3 storage, Aurora metadata, Cognito auth (SCE compute runs locally on the operator's PC, so AWS is not a sub-processor for that stage) | AWS eu-west-1 (Ireland) primary; eu-north-1 / eu-central-1 as DR | AWS GDPR DPA (auto-incorporated, Service Terms §1.14.1) |
| Amazon Web Services EMEA SARL (Luxembourg) — AWS Bedrock | AI inference for Category A content (Anthropic Claude models on AWS Bedrock; no provider-side retention; no training) | AWS eu-central-1 (Frankfurt) primary | AWS GDPR DPA (auto-incorporated, Service Terms §1.14.1) |
| Ancillary business sub-processors | Engagement administration only (email, document exchange, scheduling) — no clinical data | Per supplier disclosure | Supplier DPA (under ME-TA P05 / P17) |
Under the AWS Bedrock access pattern, ME-TA's controller's prompts and completions do not flow to Anthropic. AWS hosts the model weights under license from Anthropic and operates the inference service on AWS infrastructure; prompts and completions are not shared with Anthropic. Applying GDPR Art. 4(2) / 4(8) and the EDPB Guidelines 07/2020 factual-nexus test, Anthropic does not factually process ME-TA's controller's data on this path and is therefore not engaged as a processor under Art. 28. The Art. 28 contract is with AWS. Anthropic is the upstream model author — a tool licensor — analogous to Microsoft for Word or the PostgreSQL Global Development Group for AWS RDS for PostgreSQL.
The full rationale, including honest caveats and the procurement walk-through, is available on request as part of the DPA package.
The contractual and policy instruments behind the architecture above.
Auto-incorporated into AWS Service Terms §1.14.1 — covers all AWS-hosted data including Bedrock inference.
Download PDF →The clause that auto-incorporates the AWS GDPR DPA into every AWS customer agreement.
View on aws.amazon.com →ME-TA's AI policy: approved tools, three-stage architecture, data classification, operator hygiene, AI Act compliance.
View on policy.me-ta.dk →ME-TA's GDPR policy, sub-processor register, encryption framework.
View on policy.me-ta.dk →Sponsor-tailored Article 28 DPA. Sent on request — combines the main DPA and the AI-specific addendum, with sponsor entity details substituted.
Request via email →Live sub-processor register at policy.me-ta.dk — kept current under 30-day change-notice per P21 §21.11.
View on policy.me-ta.dk →We provide an Article 28 DPA tailored to each engagement — entity details, Annex C scope, and AI-addendum elections. Our standard turnaround for the first draft is one business day.
Email contact@me-ta.dk